Update cloned GitHub actions (#136)

github/Makefile

@@ -13,35 +13,35 @@ branch-cleanup: clone(branch-cleanup)
 
 .PHONY : auto-approve
 auto-approve: [email protected]:hmarr/auto-approve-action.git
-auto-approve: REF=a7a5750502749ef7f56c5e355b2083ce5dbda121
+auto-approve: REF=v3.1.0
 auto-approve: clone(auto-approve)
 
 .PHONY : auto-merge
 auto-merge: [email protected]:pascalgn/automerge-action.git
-auto-merge: REF=4775c532c615e0491d53bc42c0893840ae7cc07a
+auto-merge: REF=v0.15.5
 auto-merge: clone(auto-merge)
 
 .PHONY : auto-assign
 auto-assign: [email protected]:kentaro-m/auto-assign-action.git
-auto-assign: REF=5fd7cfa5a54fc1c4efee28c3e3989cf9da535c05
+auto-assign: REF=v1.2.4
 auto-assign: clone(auto-assign)
 
 .PHONY : create-pull-request
 create-pull-request: [email protected]:peter-evans/create-pull-request.git
-create-pull-request: REF=v3.4.1
+create-pull-request: REF=v4.2.2
 create-pull-request: clone(create-pull-request)
 
 .PHONY : slash-command-dispatch
 slash-command-dispatch: [email protected]:peter-evans/slash-command-dispatch.git
-slash-command-dispatch: REF=v2.1.3
+slash-command-dispatch: REF=v3.0.1
 slash-command-dispatch: clone(slash-command-dispatch)
 
 .PHONY : repository-dispatch
 repository-dispatch: [email protected]:peter-evans/repository-dispatch.git
-repository-dispatch: REF=v1.1.3
+repository-dispatch: REF=v2.1.0
 repository-dispatch: clone(repository-dispatch)
 
 .PHONY : create-or-update-comment
 create-or-update-comment: [email protected]:peter-evans/create-or-update-comment.git
-create-or-update-comment: REF=v1.4.4
+create-or-update-comment: REF=v2.1.0
 create-or-update-comment: clone(create-or-update-comment)

github/auto-approve/README.md

@@ -2,48 +2,121 @@
 
 **Name:** `hmarr/auto-approve-action`
 
-Automatically approve GitHub pull requests. The `GITHUB_TOKEN` secret must be provided as the `github-token` input for the action to work.
+Automatically approve GitHub pull requests.
 
-**Important:** use v2.0.0 or later, as v1 was designed for the initial GitHub Actions beta, and no longer works.
+**Important:** use v3 or later, as v2 uses Node.js 12, which is deprecated. If you're on an old version of GHES (earlier than 3.4) you may need to use v2 until you can upgrade. v1 was designed for the initial GitHub Actions beta, and no longer works.
 
 ## Usage instructions
 
-Create a workflow file (e.g. `.github/workflows/auto-approve.yml`) that contains a step that `uses: hmarr/auto-approve-action@v2.0.0`. Here's an example workflow file:
+Create a workflow file (e.g. `.github/workflows/auto-approve.yml`) that contains a step that `uses: hmarr/auto-approve-action@v3`. Here's an example workflow file:
 
 ```yaml
 name: Auto approve
-on: pull_request
+on: pull_request_target
 
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
-    - uses: hmarr/[email protected]
-      with:
-        github-token: "${{ secrets.GITHUB_TOKEN }}"
+      - uses: hmarr/auto-approve-action@v3
 ```
 
-
 Combine with an `if` clause to only auto-approve certain users. For example, to auto-approve [Dependabot][dependabot] pull requests, use:
 
 ```yaml
 name: Auto approve
 
+on: pull_request_target
+
+jobs:
+  auto-approve:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - uses: hmarr/auto-approve-action@v3
+```
+
+If you want to use this action from a workflow file that doesn't run on the `pull_request` or `pull_request_target` events, use the `pull-request-number` input:
+
+```yaml
+name: Auto approve
+
 on:
-  pull_request
+  workflow_dispatch:
+    inputs: pullRequestNumber
+      description: Pull request number to auto-approve
+      required: false
 
 jobs:
   auto-approve:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
-    - uses: hmarr/[email protected]
-      if: github.actor == 'dependabot[bot]' || github.actor == 'dependabot-preview[bot]'
+    - uses: hmarr/auto-approve-action@v3
       with:
-        github-token: "${{ secrets.GITHUB_TOKEN }}"
+        pull-request-number: ${{ github.event.inputs.pullRequestNumber }}
+```
+
+Optionally, you can provide a message for the review:
+
+```yaml
+name: Auto approve
+
+on: pull_request_target
+
+jobs:
+  auto-approve:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - uses: hmarr/auto-approve-action@v3
+        with:
+          review-message: "Auto approved automated PR"
+```
+
+### Approving on behalf of a different user
+
+By default, this will use the [automatic GitHub token](https://docs.github.com/en/actions/security-guides/automatic-token-authentication) that's provided to the workflow. This means the approval will come from the "github-actions" bot user. Make sure you enable the `pull-requests: write` permission in your workflow.
+
+To approve the pull request as a different user, pass a GitHub Personal Access Token into the `github-token` input. In order to approve the pull request, the token needs the `repo` scope enabled.
+
+```yaml
+name: Auto approve
+
+on: pull_request_target
+
+jobs:
+  auto-approve:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: hmarr/auto-approve-action@v3
+        with:
+          github-token: ${{ secrets.SOME_USERS_PAT }}
 ```
 
+### Approving Dependabot pull requests
+
+When a workflow is run in response to a Dependabot pull request using the `pull_request` event, the workflow won't have access to secrets. If you're trying to use a Personal Access Token (as above) but getting an error on Dependabot pull requests, this is probably why.
+
+Fortunately the fix is simple: use the `pull_request_target` event instead of `pull_request`. This runs the workflow in the context of the base branch of the pull request, which does have access to secrets.
+
 ## Why?
 
 GitHub lets you prevent merges of unapproved pull requests. However, it's occasionally useful to selectively circumvent this restriction - for instance, some people want Dependabot's automated pull requests to not require approval.
 
 [dependabot]: https://github.com/marketplace/dependabot
+
+## Code owners
+
+If you're using a [CODEOWNERS file](https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners), you'll need to give this action a personal access token for a user listed as a code owner. Rather than using a real user's personal access token, you're probably better off creating a dedicated bot user, and adding it to a team which you assign as the code owner. That way you can restrict the bot user's permissions as much as possible, and your workflow won't break when people leave the team.
+
+## Development and release process
+
+Each major version corresponds to a branch (e.g. `v2`, `v3`). The latest major version (`v3` at the time of writing) is the repository's default branch. Releases are tagged with semver-style version numbers (e.g. `v1.2.3`).

github/auto-approve/action.yml

@@ -5,8 +5,15 @@ branding:
   color: 'green'
 inputs:
   github-token:
+    default: ${{ github.token }}
     description: 'The GITHUB_TOKEN secret'
-    required: true
+    required: false
+  pull-request-number:
+    description: '(optional) The ID of a pull request to auto-approve. By default, this action tries to use the pull_request event payload.'
+    required: false
+  review-message:
+    description: '(optional) The message of the pull request review.'
+    required: false
 runs:
-  using: 'node12'
+  using: 'node16'
   main: 'dist/index.js'