# Closes Dependabot PRs while update PRs are gated off via the
# CI_ENABLE_AUTO_UPDATES repository variable. Dependabot itself cannot read
# repository variables, so the gate is enforced here.
#
# pull_request_target runs in base-branch context and therefore has
# access to repository vars/secrets and a write-scoped GITHUB_TOKEN
# even for Dependabot's PRs. This workflow does NOT check out PR code.

name: "🚫 Dependabot: Close while auto-updates disabled"

on:
  pull_request_target:
    types: [opened, reopened]

permissions:
  pull-requests: write

jobs:
  close-when-disabled:
    name: 🚫 Close Dependabot PR while gated
    if: github.event.pull_request.user.login == 'dependabot[bot]' && vars.CI_ENABLE_AUTO_UPDATES != 'true'
    runs-on: ubuntu-26.04
    steps:
      - name: 📪 Close PR
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_URL: ${{ github.event.pull_request.html_url }}
        run: gh pr close "$PR_URL" --comment "Auto-closed by \`entry-pr-open-dependabot-close.yml\`. The repository variable \`CI_ENABLE_AUTO_UPDATES\` is not set to \`true\`, so update PRs are disabled. Set it to \`true\` under **Settings → Secrets and variables → Actions → Variables** to allow Dependabot PRs."