Dependabot automerge.

.github/workflows/molecule.yml

@@ -17,12 +17,16 @@ on:
     tags_ignore:
       - '*'
   pull_request:
+  pull_request_target:
   schedule:
-    - cron: '31 16 16 * *'
+    # - cron: '31 16 16 * *'
+    - cron: '31 16 * * *'
 
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions: write-all
+
 concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}
   cancel-in-progress: true
@@ -77,3 +81,25 @@ jobs:
         with:
           image: ${{ matrix.config.image }}
           tag: ${{ matrix.config.tag }}
+
+  dependabot:
+    needs: test
+    runs-on: ubuntu-latest
+    if: ${{ github.actor == 'dependabot[bot]' || github.actor == 'buluma' && github.event_name == 'pull_request'}}
+    steps:
+      - uses: "actions/checkout@master"
+      - name: Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Approve a PR
+        run: gh pr review --approve "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: "Merge Dependabot PR"
+        run: gh pr merge --auto --merge "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release_drafter.yml

@@ -11,6 +11,7 @@ on:
     branches:
       - master
       - main
+      - dependabot/**
       - testing
     paths-ignore:
       - '**/README.md'
@@ -19,9 +20,9 @@ on:
   pull_request:
     # Only following types are handled by the action, but one can default to all as well
     types: [opened, reopened, synchronize]
+  pull_request_target:
 
-permissions:
-  contents: write
+permissions: write-all
 
 concurrency:
   group: ${{ github.ref }}-${{ github.workflow }}