on:
  pull_request_review:
    types: submitted

jobs:
  approved_pr:
    name: Automerge approved PRs
    permissions:
      contents: write
      pull-requests: write
      id-token: write
    if: ${{ github.event.review.state == 'approved' && github.repository == 'aws-actions/configure-aws-credentials' && (github.event.review.author_association == 'OWNER' || github.event.review.author_association == 'MEMBER' || github.event.review.user.login == 'aws-sdk-osds') }}
    runs-on: ubuntu-latest
    steps:
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-region: us-west-2
          role-to-assume: ${{ secrets.SECRETS_AWS_PACKAGING_ROLE_TO_ASSUME }}
          role-duration-seconds: 900
          role-session-name: SecretsManagerFetch
      - name: Get bot user token
        uses: aws-actions/aws-secretsmanager-get-secrets@v2
        with:
          parse-json-secrets: true
          secret-ids: |
            ${{ secrets.OSDS_PACKAGING_ROLE }}
      - name: Enable PR automerge
        run: gh pr merge --auto --squash "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GITHUB_TOKEN: ${{ env.OSDS_ACCESS_TOKEN }}