Add content scanning resource #3641

	name: Add CHANGELOG for dependabot changes
	on: pull_request_target
	permissions:
	pull-requests: write
	issues: write
	repository-projects: write
	contents: write
	jobs:
	dependabot:
	runs-on: ubuntu-latest
	if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
	steps:
	- uses: actions/checkout@v4
	- run: \|
	gh pr checkout $PR_URL

	title=$(gh pr view $PR_URL --json title \| jq -r .title)

	# "group with" is the title used when dependabot has a grouped update.
	if [[ "$title" == "group with" ]]; then
	output=$(gh pr view $PR_URL \| grep 'Updates')
	else
	# clean out the 'build(deps): ' prefix.
	output="${title//build(deps): /}"
	fi

	IFS=$'\n'

	while read -r line; do
	updates+=("$line")
	done <<< "$output"

	for value in ${updates[@]}; do
	value="${value//Updates/bump}"
	cat << EOF >> .changelog/$PR_NUMBER.txt
	\`\`\`release-note:dependency
	provider: $value
	\`\`\`
	EOF
	done

	git config user.name github-actions[bot]
	git config user.email github-actions[bot]@users.noreply.github.com
	git add .changelog/$PR_NUMBER.txt
	git commit -m "add CHANGELOG for #$PR_NUMBER"
	git push
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	PR_URL: ${{ github.event.pull_request.html_url }}
	PR_NUMBER: ${{ github.event.pull_request.number }}

Provide feedback