ci: add Dependabot auto-merge workflow

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,37 @@
+name: Dependabot auto-merge
+
+# Automatically merges Dependabot PRs once all required CI checks pass.
+# Only patch and minor version bumps are auto-merged; major bumps require
+# manual review (breaking changes are too risky to merge unseen).
+#
+# Requires: repository Settings → General → "Allow auto-merge" must be on
+# (enabled via the GitHub API when this workflow was added).
+
+on:
+  pull_request:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    name: Auto-merge Dependabot PRs
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - name: Fetch Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Enable auto-merge for patch and minor updates
+        # Major version bumps need a human look — skip them here.
+        if: |
+          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
+          steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        run: gh pr merge --auto --merge "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}