ci: dependabot auto-merge with compatibility checks

[dogancanbakir]

Fixes #5

Adds dependabot.yml and the shared auto-merge workflow from HappyHackingSpace/actions@v1. Majors stay for review.

Summary by CodeRabbit

• Chores
  • Automated dependency update checks are scheduled weekly, with minor and patch updates grouped together and a three-day cooldown.
  • Eligible pull requests opened by Dependabot can be automatically merged.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: cce3b302-03b9-4630-acf0-a38a45f546f7

📥 Commits

Reviewing files that changed from the base of the PR and between 40727e4 and 6e18b4c.

📒 Files selected for processing (2)

• .github/dependabot.yml
• .github/workflows/dependabot.yaml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The changes configure weekly GitHub Actions dependency updates and add a workflow that conditionally runs a reusable auto-merge workflow for Dependabot-authored pull requests.

Changes

Dependabot automation

Layer / File(s)	Summary
GitHub Actions update policy .github/dependabot.yml	Dependabot checks for GitHub Actions updates weekly, applies a three-day default cooldown, and groups minor and patch updates.
Dependabot pull request workflow .github/workflows/dependabot.yaml	The workflow responds to pull request open, synchronize, and reopen events. It grants the specified repository permissions and runs a reusable auto-merge workflow when the pull request author is dependabot[bot].

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 6e18b

Major dependency updates remain for review, while the configured auto-merge workflow excludes them. No concrete issue requiring resolution before merge is established.

Architecture Summary

Architecture risk: 🔵 Low · up to 6e18b

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/dependabot.yml: Adds Dependabot settings for weekly GitHub Actions updates in /, applies a default three-day cooldown, and groups minor and patch update types.
• observed — Modified behavior in .github/workflows/dependabot.yaml: Adds a workflow for the listed pull request events, with the specified repository permissions and a reusable auto-merge job conditional on the author being dependabot[bot].

🚥 Pre-merge checks | ✅ 4 | ❓ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	Issue #5 requires Dependabot version updates and auto-merge of patch/minor updates only after compatibility checks. .github/dependabot.yml enables weekly GitHub Actions updates and groups minor and …	Provide reviewable evidence of the behavior of dependabot-auto-merge.yaml@v1, including its compatibility-check gate and its handling of major updates.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: automating Dependabot merges after compatibility checks.
Out of Scope Changes check	✅ Passed	Both added files support issue #5: .github/dependabot.yml configures version updates, and .github/workflows/dependabot.yaml invokes the Dependabot auto-merge workflow. The diff shows no unrelated …
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Linked Issues check

Explanation

Issue #5 requires Dependabot version updates and auto-merge of patch/minor updates only after compatibility checks. .github/dependabot.yml enables weekly GitHub Actions updates and groups minor and patch updates. .github/workflows/dependabot.yaml invokes HappyHackingSpace/actions/.github/workflows/dependabot-auto-merge.yaml@v1 for Dependabot pull requests. The referenced reusable workflow is not included in this PR, so the available evidence does not establish that it checks compatibility or leaves major updates for review.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the weekly trail,
While patches gather, neat and small.
Three days pass before they hop,
A Dependabot pull request calls.
Checks and statuses greet the run,
Then safe merges wait on bot-authored fun.}

_{Comment @coderabbitai help to get the list of available commands.}