name: dependabot trust check (auth-bypass — Synacktiv 2023)
on:
  pull_request_target:
    branches: [main]

jobs:
  auto-merge:
    runs-on: ubuntu-latest
    if: ${{ github.actor == 'dependabot[bot]' }}
    steps:
      - name: Checkout PR
        uses: actions/checkout@v4
      - name: Approve
        run: gh pr review --approve
