ci: configured auto-merge for dependabots

* All groups are checked once a week and each produce at most 1 PR.
* All dependabot PRs are auto-approved

Caveats:
* this requires auto-merge to be enabled in the repository settings
  [done]
* this requires all desired tests to be required in the branch
  protection rule [done]

- package-ecosystem: "github-actions"
    # 1. development-dependencies are auto-merged

- package-ecosystem: "gomod"
    # We define 4 groups of dependencies to regroup update pull requests:
    # - development (e.g. test dependencies)
    # - go-openapi updates
    # - golang.org (e.g. golang.org/x/... packages)
    # - other dependencies (direct or indirect)
    #
    #
    # Auto-merging policy, when requirements are met:
    # 1. development-dependencies are auto-merged
    # 2. golang.org-dependencies are auto-merged
    # 3. go-openapi patch updates are auto-merged. Minor/major version updates require a manual merge.
    # 4. other dependencies require a manual merge

Signed-off-by: Frederic BIDON <[email protected]>

.github/dependabot.yaml

@@ -3,36 +3,55 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
-      #interval: "weekly"
-      #day: "friday"
-    open-pull-requests-limit: 3          # <- default is 5
+      interval: "weekly"
+      day: "friday"
+    open-pull-requests-limit: 2          # <- default is 5
     groups:                              # <- group all github actions updates in a single PR
+      # 1. development-dependencies are auto-merged
       development-dependencies:
         dependency-type: development
         patterns:
           - '*'
 
   - package-ecosystem: "gomod"
+    # We define 4 groups of dependencies to regroup update pull requests:
+    # - development (e.g. test dependencies)
+    # - go-openapi updates
+    # - golang.org (e.g. golang.org/x/... packages)
+    # - other dependencies (direct or indirect)
+    #
+    # * All groups are checked once a week and each produce at most 1 PR.
+    # * All dependabot PRs are auto-approved
+    #
+    # Auto-merging policy, when requirements are met:
+    # 1. development-dependencies are auto-merged
+    # 2. golang.org-dependencies are auto-merged
+    # 3. go-openapi patch updates are auto-merged. Minor/major version updates require a manual merge.
+    # 4. other dependencies require a manual merge
     directory: "/"
     schedule:
-      interval: "daily"
-      #interval: "weekly"
-      #day: "friday"
-    open-pull-requests-limit: 3
+      interval: "weekly"
+      day: "friday"
+    open-pull-requests-limit: 4
     groups:
       development-dependencies:
         dependency-type: development
         patterns:
           - "github.com/stretchr/testify"
+
+      golang.org-dependencies:
+        dependency-type: production
+        patterns:
+          - "golang.org/*"
+
       go-openapi-dependencies:
         dependency-type: production
         patterns:
           - "github.com/go-openapi/*"
 
-      other-direct-dependencies:
+      other-dependencies:
         dependency-type: production
         exclude-patterns:
           - "github.com/go-openapi/*"
           - "github.com/stretchr/testify"
-
+          - "golang.org/*"

.github/workflows/auto-merge.yml

@@ -14,7 +14,7 @@ jobs:
         id: metadata
         uses: dependabot/fetch-metadata@v1
 
-      - name: Auto-approve dependabot PRs
+      - name: Auto-approve all dependabot PRs
         run: gh pr review --approve "$PR_URL"
         env:
           PR_URL: ${{github.event.pull_request.html_url}}
@@ -34,3 +34,10 @@ jobs:
           PR_URL: ${{github.event.pull_request.html_url}}
           GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
 
+      - name: Auto-merge dependabot PRs for golang.org updates
+        if: contains(steps.metadata.outputs.dependency-group, 'golang.org-dependencies')
+        run: gh pr merge --auto --rebase "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
+