ci-dependabot.yml

# NOTE: This name appears in GitHub's Checks API and in workflow's status badge.
name: ci-dependabot

# Trigger the workflow when:
on:
  # When a pull request event occurs for a pull request against one of the
  # matched branches.
  pull_request:
    branches: [master]

jobs:
  add-changelog:
    # NOTE: This name appears in GitHub's Checks API.
    name: add-changelog
    # Trigger job only for dependency update bot.
    if: github.actor == 'dependabot[bot]'
    runs-on: ubuntu-latest
    # Permissions needed to update PR.
    permissions:
      # Enable creating and updating files.
      contents: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          # Needed for correct git commit --amend.
          fetch-depth: 0
          # Checkout pull request HEAD commit instead of merge commit.
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Create Change Log file
        env:
          # There's no support for escaping this for use in a shell command.
          # GitHub's recommendation is to pass it through the environment.
          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
          TITLE: ${{ github.event.pull_request.title }}
          FILE_NAME: .changelog/${{ github.event.pull_request.number }}.internal.md
        run: |
          echo "$TITLE" > "$FILE_NAME"
      - name: Commit Change Log file
        env:
          FILE_NAME: .changelog/${{ github.event.pull_request.number }}.internal.md
        run: |
          # Set git user email and name to match author of the last commit.
          git config --local user.email "$(git log --pretty='%ae' -1)"
          git config --local user.name "$(git log --pretty=format:'%an' -1)"
          git add "$FILE_NAME"
          git commit --amend --no-edit
      - name: Push changes back to branch
        run: |
          git push --force-with-lease origin "HEAD:refs/heads/$GITHUB_HEAD_REF"