Make auto-merge more conservative

Only do auto-merges when the pull-request contains exactly one commit.
This prevents pull-requests which are manually amended from being merged
automatically.

Author: thomas-zahner

.github/workflows/auto-merge.yml

@@ -8,8 +8,17 @@ permissions:
 jobs:
   auto-merge:
     runs-on: ubuntu-latest
-    if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'lycheeverse/lychee'
+    if: |
+      github.repository == 'lycheeverse/lychee' &&
+      github.event.pull_request.user.login == 'dependabot[bot]'
     steps:
+      - name: Commits are by Dependabot only
+        run: |
+          authors=$(gh pr view "$PR_URL" --json commits --jq '.commits[].authors[].login' | uniq)
+          if [[ "$authors" != "dependabot[bot]" ]]; then
+            echo PR seems to have been manually modified. Skipping auto merge!
+            exit 0
+          fi
       - name: Enable auto-merge for Dependabot PRs
         # Merge all updates as long as they pass CI
         run: gh pr merge --auto --merge "$PR_URL"