fix: wait for checks before auto-merging dependencies

.github/dependabot.yml

@@ -3,6 +3,8 @@ updates:
   - package-ecosystem: 'maven'
     directory: 'stackrox-container-image-scanner/'
     open-pull-requests-limit: 1
+    labels:
+      - auto-merge
     schedule:
       interval: "daily"
     ignore:
@@ -11,11 +13,15 @@ updates:
   - package-ecosystem: 'gradle'
     directory: 'functionaltest-jenkins-plugin/'
     open-pull-requests-limit: 1
+    labels:
+      - auto-merge
     schedule:
       interval: "daily"
 
   - package-ecosystem: "github-actions"
     directory: "/"
     open-pull-requests-limit: 1
+    labels:
+      - auto-merge
     schedule:
       interval: 'daily'

.github/workflows/auto-merge.yml

@@ -1,56 +1,26 @@
 name: auto-merge
 
 on:
-  pull_request_target:
+  schedule:
+    - cron: '0 * * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: auto-merge
+  cancel-in-progress: false
 
 jobs:
   auto-merge:
+    name: Enable auto-merge for eligible PRs
     runs-on: ubuntu-latest
-    if: github.actor == 'dependabot[bot]'
-    steps:
-      - name: Verify Dependabot provenance
-        env:
-          ACTOR: ${{ github.actor }}
-          GH_REPOSITORY: ${{ github.repository }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
-          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          # 1. Verify actor
-          if [[ "$ACTOR" != "dependabot[bot]" ]]; then
-            echo "::error::Invalid actor: $ACTOR"
-            exit 1
-          fi
-
-          # 2. Verify PR author type
-          AUTHOR_TYPE=$(gh api repos/$GH_REPOSITORY/pulls/$PR_NUMBER \
-            --jq '.user.type')
-
-          if [[ "$AUTHOR_TYPE" != "Bot" ]]; then
-            echo "::error::PR author is not a bot: $AUTHOR_TYPE"
-            exit 1
-          fi
+    if: github.repository_owner == 'stackrox'
 
-          # 3. Verify branch naming convention
-          if [[ ! "$PR_HEAD_REF" =~ ^dependabot/ ]]; then
-            echo "::error::Branch doesn't match Dependabot pattern"
-            exit 1
-          fi
-
-          # 4. Verify commit signature
-          VERIFIED=$(gh api repos/$GH_REPOSITORY/commits/$PR_HEAD_SHA \
-            --jq '.commit.verification.verified')
-
-          if [[ "$VERIFIED" != "true" ]]; then
-            echo "::error::Commit not verified"
-            exit 1
-          fi
-
-          echo "✓ All provenance checks passed"
-
-      - name: Enable auto-merge for Dependabot PRs
-        run: gh pr merge --auto --squash "$PR_URL" && gh pr review --approve "$PR_URL"
-        env:
-          GH_TOKEN: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }}
-          PR_URL: ${{ github.event.pull_request.html_url }}
+    steps:
+      - name: Run auto-merge action
+        uses: stackrox/actions/automerge@8fcfacbfc4629361cca5573aba147be2155ba7e9
+        with:
+          github-token: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }}