refactor automerge github action to be more efficient

[0xdevalias]

The previous automerge action runs on pull_request, and polls/sleeps until checks have been completed.

This refactored version instead runs on check_suite completed.

Note: I haven't fully tested this, so I'm not 100% sure if it will work as is, but wanted to raise it for a discussion point.

See Also

• Support auto merge in Dependabot dependabot/dependabot-core#1973
• https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions#enabling-automerge-on-a-pull-request
• https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging
• https://docs.github.com/en/rest/branches/branch-protection#get-branch-protection
• https://docs.github.com/en/actions/security-for-github-actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
• https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
• https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps#repository-permissions-for-administration

  • GET /repos/{owner}/{repo}/branches/{branch}/protection - read - UAT / IAT

[0xdevalias]

I'm not 100% sure if this would actually run properly with the default workflow secrets.GITHUB_TOKEN permissions.

I'm also not sure if it's actually needed if we leave this action triggering on check_suite completed. Originally I was going to have the action still trigger on pull_request, but only enable automerge if branch protections + require status checks were enabled, as a failsafe to ensure it wasn't merged prematurely if those protections weren't enabled.

If we're sure that they are enabled for the repo, it may also be fine to just remove the check from this action entirely; in which case it would probably be equally correct to have it trigger on pull_request, or check_suite completed; as the branch protections would be sufficient to ensure it only merges when the checks complete successfully:

• https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging

[0xdevalias]

A PR was automerged recently, despite there being failing tests (#382 (comment)); which I think is a bug/limitation in the current automerge, that would likely be resolved by this PR:

So this seems like it never should have passed and been able to be merged.. probably a race condition/similar bug in the automerge GitHub action that likely would be resolved by the improvements raised in:

• refactor automerge github action to be more efficient #346

Originally posted by @0xdevalias in #382 (comment)

Edit: See the following issue:

• failing test: src/test/local.e2etest.ts:1:468 - Unminifies an example file successfully - AssertionError [ERR_ASSERTION]: Expected "UNREADABLE" but got GOOD #384