ci: auto-merge Dependabot Maven updates

.github/workflows/auto-merge-dependabot.yml

@@ -0,0 +1,39 @@
+name: Auto-merge Dependabot Maven updates
+
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  enable-auto-merge:
+    if: >-
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      github.event.pull_request.base.ref == 'main'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify Maven-only update
+        id: scope
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+
+          files="$(gh api "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files" --paginate --jq '.[].filename')"
+          if [[ -z "${files}" ]] || grep -Evq '(^|/)pom\.xml$' <<< "${files}"; then
+            echo "is_maven_update=false" >> "${GITHUB_OUTPUT}"
+            exit 0
+          fi
+          echo "is_maven_update=true" >> "${GITHUB_OUTPUT}"
+
+      - name: Enable rebase auto-merge
+        if: steps.scope.outputs.is_maven_update == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: gh pr merge "${PR_NUMBER}" --auto --rebase

scripts/verify-supply-chain-workflows-test.sh

@@ -107,6 +107,20 @@ jobs:
         if: steps.version.outputs.is_snapshot == 'true'
         run: ./mvnw deploy
 YAML
+assert_rejects "${temp_dir}"
+cat > "${temp_dir}/.github/workflows/auto-merge-dependabot.yml" <<'YAML'
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize]
+permissions:
+  contents: read
+  pull-requests: write
+jobs:
+  enable-auto-merge:
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    steps:
+      - run: gh pr merge "${PR_NUMBER}" --auto --rebase
+YAML
 cat > "${temp_dir}/.github/workflows/codeql.yml" <<'YAML'
 permissions:
   contents: read

scripts/verify-supply-chain-workflows.sh

@@ -26,6 +26,7 @@ require_file ".github/workflows/codeql.yml"
 require_file ".github/workflows/release.yml"
 require_file ".github/workflows/ci.yml"
 require_file ".github/workflows/snapshot.yml"
+require_file ".github/workflows/auto-merge-dependabot.yml"
 
 require_text ".github/dependabot.yml" "package-ecosystem: maven"
 require_text ".github/dependabot.yml" "package-ecosystem: github-actions"
@@ -49,6 +50,10 @@ require_text ".github/workflows/release.yml" "release-evidence"
 require_text ".github/workflows/snapshot.yml" "sed -n 's/^\\[INFO\\] \\[stdout\\] //p'"
 require_text ".github/workflows/snapshot.yml" "is_snapshot=true"
 require_text ".github/workflows/snapshot.yml" "if: steps.version.outputs.is_snapshot == 'true'"
+require_text ".github/workflows/auto-merge-dependabot.yml" "pull_request_target:"
+require_text ".github/workflows/auto-merge-dependabot.yml" "dependabot[bot]"
+require_text ".github/workflows/auto-merge-dependabot.yml" "pull-requests: write"
+require_text ".github/workflows/auto-merge-dependabot.yml" 'gh pr merge "${PR_NUMBER}" --auto --rebase'
 if grep -Fq -- "-DforceStdout | tail -n 1" "${root_dir}/.github/workflows/snapshot.yml"; then
     echo ".github/workflows/snapshot.yml must not use bare Maven 4 version extraction" >&2
     exit 1