Automate safe Dependabot updates

.github/dependabot.yml

@@ -6,20 +6,19 @@
 # has gone stale -- a tag at least reads as a version. This is the thing that
 # tells you.
 #
-# Grouped into one pull request rather than one per action. These are all the
-# same kind of change, and a pin bump arriving alone every few days is how pin
-# bumps stop being read at all.
-#
-# Scoped to github-actions. The aviorstudio/* and nicodes/* refs stay on version
-# tags by decision, and dependabot will offer those as version bumps rather than
-# opaque SHA changes.
+# Minor and patch updates are grouped: they share the same risk profile and CI
+# can merge them without ceremony. Major updates are deliberately excluded, so
+# Dependabot opens one reviewable pull request for each breaking-change boundary.
 version: 2
 updates:
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
     groups:
-      actions:
+      actions-minor-patch:
         patterns:
           - "*"
+        update-types:
+          - minor
+          - patch

.github/workflows/dependabot.yml

@@ -0,0 +1,31 @@
+name: Dependabot
+
+# Dependabot's minor and patch action updates are grouped in dependabot.yml.
+# Once the required CI check passes, this marks only those low-risk updates for
+# squash merge. Major updates never satisfy the condition and remain manual.
+on:
+  pull_request:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Read Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Enable auto-merge for minor and patch updates
+        if: >-
+          steps.metadata.outputs.update-type == 'version-update:semver-minor' ||
+          steps.metadata.outputs.update-type == 'version-update:semver-patch'
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}