feat: support automerge of npm_and_yarn group PRs

[toomuchdesign]

Feature Proposal

Dependabot seems to open a special kind of PR (npm_and_yarn group) which this action doesn't merge because of the lack of an explicit semver bump value:

Semver bump '' is invalid!

"npm_and_yarn group" PR metadata example:

 outputs.dependency-names: cookie, light-my-request
 outputs.dependency-type: indirect
 outputs.update-type: null
 outputs.directory: /
 outputs.package-ecosystem: npm_and_yarn
 outputs.target-branch: master
 outputs.previous-version: 
 outputs.new-version: 
 outputs.compatibility-score: 0
 outputs.maintainer-changes: true
 outputs.dependency-group: npm_and_yarn
 outputs.alert-state: 
 outputs.ghsa-id: 
 outputs.cvss: 0

Motivation

The goal of this PR is recognise such PRs so that they can be merged automatically.

Extra information

I decided to detect by default npm_and_yarn group PRs using dependency-group metadata prop.

Another approach could consist of exposing an option to whitelist specific PRs by metadata. The API of such option should be carefully designed, though.

Happy to review the detection logic in case it's too loose.

Checklist

• run npm run test and npm run benchmark
• tests and/or benchmarks are included
• documentation is changed or added
• commit message and code follows the Developer's Certification of Origin
  and the Code of conduct

[github-actions]

No linked issues found. Please add the corresponding issues in the pull request description.
Use GitHub automation to close the issue when a PR is merged

[simoneb]

Thanks for the PR. I'm not entirely sure how the logic would work though. The PR is handling an "update group" gracefully now, but we are missing a fundamental piece of information which is the "update type" in any case. So, even if we handle this type of grouped update gracefully, how can we apply the logic whereby we only merge certain semver version bumps, if that information is missing? Maybe I'm missing something

[toomuchdesign]

You're right.
I initially assumed the missing update-type was expected within a "dependency-type: indirect" PR, but it's not the case. It is actually a long standing Dependabot issue.

I'm closing this PR and opening a new one proposing a new target- option to specifically handle indirect dependency type PRs.

Thank you Simone.