From e8dc3a752aa570fc2285d47e64b37e130e0c5c13 Mon Sep 17 00:00:00 2001
From: d-oit <6849456+d-oit@users.noreply.github.com>
Date: Tue, 11 Aug 2026 20:27:46 +0200
Subject: [PATCH] feat(ci): add dependabot auto-merge workflow template

---
 .../dependabot-auto-merge.properties.json     |  6 ++++
 .../dependabot-auto-merge.yml                 | 33 +++++++++++++++++++
 src/lib/__tests__/workflows.test.ts           | 25 ++++++++++++++
 3 files changed, 64 insertions(+)
 create mode 100644 .github/workflow-templates/dependabot-auto-merge.properties.json
 create mode 100644 .github/workflow-templates/dependabot-auto-merge.yml

diff --git a/.github/workflow-templates/dependabot-auto-merge.properties.json b/.github/workflow-templates/dependabot-auto-merge.properties.json
new file mode 100644
index 00000000..72e17be3
--- /dev/null
+++ b/.github/workflow-templates/dependabot-auto-merge.properties.json
@@ -0,0 +1,6 @@
+{
+  "name": "Dependabot Auto-Merge",
+  "description": "Automatically approves and squash-merges dependency update PRs that carry the 'automerge' label.",
+  "iconName": "example-icon",
+  "categories": ["Dependency management", "Continuous integration"]
+}
diff --git a/.github/workflow-templates/dependabot-auto-merge.yml b/.github/workflow-templates/dependabot-auto-merge.yml
new file mode 100644
index 00000000..678e90c8
--- /dev/null
+++ b/.github/workflow-templates/dependabot-auto-merge.yml
@@ -0,0 +1,33 @@
+---
+name: Dependabot Auto-Merge
+
+# Automatically approves and enables auto-merge for dependabot/jules PRs
+# that have the 'automerge' label. No unexpected auto-merges.
+
+# yamllint disable-line rule:truthy
+on: pull_request
+
+permissions:
+  contents: read
+
+jobs:
+  auto-merge:
+    # Only run for dependabot or jules bots with the automerge label
+    if: >-
+      (github.actor == 'dependabot[bot]'
+       || github.actor == 'google-labs-jules[bot]')
+      && contains(
+         github.event.pull_request.labels.*.name, 'automerge')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      pull-requests: write
+      contents: write
+    steps:
+      - name: Approve and enable auto-merge
+        run: |
+          gh pr review --approve "$PR_URL"
+          gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/src/lib/__tests__/workflows.test.ts b/src/lib/__tests__/workflows.test.ts
index 0317d3eb..1ef2936a 100644
--- a/src/lib/__tests__/workflows.test.ts
+++ b/src/lib/__tests__/workflows.test.ts
@@ -311,5 +311,30 @@ describe('GitHub Actions Workflows', () => {
       expect(properties.name).toBe('CI Pipeline')
       expect(properties.description.length).toBeGreaterThan(0)
     })
+
+    it('should have a valid dependabot-auto-merge template with properties file', () => {
+      const templatePath = join(
+        process.cwd(),
+        '.github/workflow-templates/dependabot-auto-merge.yml'
+      )
+      expect(existsSync(templatePath)).toBe(true)
+      const template = parse(readFileSync(templatePath, 'utf-8'))
+      expect(template).toBeDefined()
+      expect(template.name).toBe('Dependabot Auto-Merge')
+
+      const job = template.jobs['auto-merge']
+      expect(job).toBeDefined()
+      expect(job.if).toContain('automerge')
+
+      const propertiesPath = join(
+        process.cwd(),
+        '.github/workflow-templates/dependabot-auto-merge.properties.json'
+      )
+      const properties = JSON.parse(
+        readFileSync(propertiesPath, 'utf-8')
+      ) as { name: string; description: string }
+      expect(properties.name).toBe('Dependabot Auto-Merge')
+      expect(properties.description.length).toBeGreaterThan(0)
+    })
   })
 })
\ No newline at end of file