approve-flake-lock-prs.yml

# This job applies one approval automatically to the automated `flake.lock` PRs
# This helps us keep up with the weekly automated PRs, but still requires at least 1
# human manual approval.
name: Approve flake.lock PRs (still require 1 human approval)
permissions:
  pull-requests: write
on:
  pull_request:
    paths: # only run if flake.lock has changed
      - flake.lock
jobs:
  approve-flake-lock-prs:
    runs-on: ubuntu-latest
    if: github.actor == 'github-actions[bot]' && github.event.pull_request.labels.*.name == 'flake.lock automation'
    steps:
      - uses: actions/checkout@v4
      - name: Approve flake.lock PRs (still requires 1 human approval)
        run: |
          # only run if only exactly 1 file is changed;
          # this combined with the `paths:` filter on the job itself
          # ensures that the PR changes ONLY flake.lock and no other files
          if [[ "$(git diff --name-only HEAD..origin/main | wc -l)" = 1 ]]; then
            gh pr review --approve "$PR_URL"
          end
        env:
          PR_URL: ${{github.event.pull_request.html_url}}
          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}