From 9ada277c3c7cf80ce78b79c6d75f3d4445eb55b6 Mon Sep 17 00:00:00 2001
From: Xi Xu <i@xi-xu.me>
Date: Fri, 3 Jul 2026 23:33:58 +0800
Subject: [PATCH] ci: trigger Dependabot auto-merge from workflow runs

---
 .github/workflows/dependabot-auto-merge.yml | 24 ++++++++++-----------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index e90fae6..9246fda 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -1,18 +1,10 @@
 name: Dependabot Auto Merge
 
 on:
-  pull_request_target:
-    types:
-      - opened
-      - synchronize
-      - reopened
-      - ready_for_review
-  schedule:
-    - cron: "*/30 * * * *"
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch || github.run_id }}
   cancel-in-progress: false
 
 permissions:
@@ -53,9 +45,17 @@ jobs:
             };
 
             const findCandidatePulls = async () => {
-              if (context.eventName === "pull_request_target") {
-                const pr = context.payload.pull_request;
-                return pr?.user?.login === "dependabot[bot]" && pr?.state === "open" ? [pr] : [];
+              const branch = context.payload.workflow_run?.head_branch;
+              if (context.eventName === "workflow_run" && branch) {
+                const { data: pulls } = await github.rest.pulls.list({
+                  owner,
+                  repo,
+                  state: "open",
+                  head: owner + ":" + branch,
+                  per_page: 10,
+                });
+
+                return pulls.filter((pr) => pr.user?.login === "dependabot[bot]");
               }
 
               const pulls = await github.paginate(github.rest.pulls.list, {