ci: add dependabot auto-merge for minor/patch updates

[chitcommit]

Automatically approves and auto-merges dependabot PRs for minor/patch semver bumps. Major version bumps still require manual review.

Summary by CodeRabbit

• Chores
  • Automated approval and merging of dependency updates for minor and patch versions, improving maintenance efficiency and reducing manual review overhead for compatible dependency upgrades.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[github-actions]

1. @coderabbitai review
2. @copilot review
3. @codex review
4. @claude review
   Adversarial review request: evaluate security, policy bypass paths, regression risk, and merge-gating bypass attempts.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0b62bc6c-7e6e-4762-aa3a-e7fd3d25aad3

📥 Commits

Reviewing files that changed from the base of the PR and between db80f1b and 8ffbd04.

📒 Files selected for processing (1)

• .github/workflows/dependabot-auto-merge.yml

---

📝 Walkthrough

Walkthrough

A new GitHub Actions workflow is added to automatically merge Dependabot minor and patch version updates. The workflow triggers on pull requests created by the Dependabot bot, fetches update metadata, approves qualifying updates, and performs squash merges.

Changes

Cohort / File(s)	Summary
GitHub Actions Workflow .github/workflows/dependabot-auto-merge.yml	New workflow that automates approval and squash merging of Dependabot PRs for semver-minor and semver-patch updates. Includes conditional logic to filter update types and passes PR URL and GitHub token as environment variables.

Sequence Diagram(s)

sequenceDiagram
    participant GitHub as GitHub
    participant Action as Dependabot<br/>Auto-Merge Action
    participant API as GitHub API
    participant Dependabot as Dependabot

    GitHub->>Action: Trigger on pull_request_target<br/>(actor: dependabot[bot])
    Action->>API: Fetch Dependabot metadata
    API-->>Action: Return update-type
    
    alt update-type is minor or patch
        Action->>API: POST approve PR
        API-->>Action: Approval confirmed
        Action->>API: PUT merge PR (squash)
        API-->>Action: PR merged
    else update-type is major
        Action->>Action: Skip approval & merge
    end

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 Dependabot's dance, now fully automated,
Minor and patch updates, quickly validated,
Squash merges flow like streams so clear,
Dependencies fresh, throughout the year! 🌿✨

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch chore/dependabot-auto-merge

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}