Add Dependabot auto-merge workflow

[Copilot]

Dependabot PRs with all checks passing should be merged automatically without manual intervention.

Changes

• New workflow .github/workflows/dependabot.yml: triggers on pull_request, skips non-Dependabot actors, and calls gh pr merge --auto --squash to enable GitHub's native auto-merge — the merge fires only after all required status checks pass

jobs:
  dependabot:
    runs-on: ubuntu-latest
    if: github.actor == 'dependabot[bot]'
    steps:
      - name: auto-merge
        run: gh pr merge --auto --squash "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Requires contents: write and pull-requests: write permissions. Style follows existing workflows (on: list notation, same job structure).

[Copilot]

Pull request overview

Adds a GitHub Actions workflow to automatically enable GitHub’s native auto-merge for Dependabot PRs once required checks pass, reducing manual maintenance overhead.

Changes:

• Introduces .github/workflows/dependabot.yml workflow triggered on PR events.
• Uses gh pr merge --auto --squash to enable auto-merge on qualifying PRs.
• Grants workflow-level contents: write and pull-requests: write permissions to allow merging.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The job gating uses github.actor == 'dependabot[bot]', which depends on who triggered the event rather than who owns the PR. If a Dependabot-authored PR is updated or re-run by a maintainer, github.actor may no longer be dependabot[bot], and auto-merge won’t be (re)enabled. Prefer checking the PR author instead (e.g., github.event.pull_request.user.login == 'dependabot[bot]').

Suggested change

	if: github.actor == 'dependabot[bot]'
	if: github.event.pull_request.user.login == 'dependabot[bot]'

[Copilot]

on: pull_request without specifying types runs on all PR activity (including closed). Dependabot can close its own PRs (e.g., superseded updates), and gh pr merge --auto will fail/no-op on closed PRs, creating noisy failing workflow runs. Consider restricting trigger types (e.g., opened, reopened, synchronize, ready_for_review) and/or adding an if: guard that the PR state is open.

Suggested change

	- pull_request
	pull_request:
	types:
	- opened
	- reopened
	- synchronize
	- ready_for_review