ci: auto-merge patch and minor Dependabot updates

[rrrutledge]

What this does

Adds .github/workflows/dependabot-auto-merge.yml, which approves a Dependabot PR and turns on GitHub's native auto-merge for patch and minor version updates. GitHub then merges the PR on its own once branch protection is satisfied. Major-version updates are left alone and still open a normal PR for a human to review.

Important: this workflow is inert until two repo settings are in place

The workflow only requests auto-merge. GitHub will not actually merge anything until a maintainer applies both of these (they need admin, so they are not part of this PR):

1. Enable auto-merge on the repo. Settings → General → Pull Requests → check Allow auto-merge. Without this, gh pr merge --auto has nothing to enable.
2. Require the CI checks on main. Settings → Branches → the main protection rule → Require status checks to pass before merging, and add the checks that must be green (e.g. the Spelling & Styles / vale job, and CodeQL). This is what makes auto-merge wait for green instead of merging as soon as the PR is approved.

Until step 2 is in place, auto-merge would merge a PR the moment it has the one required approval, without waiting for CI - so step 2 is the piece that delivers "check the build passes first."

Tradeoff to weigh before enabling

• Required status checks apply to every PR, not just Dependabot's. Turning them on changes the merge gate for all contributors: their PRs would also have to pass those checks before merge. That is generally good hygiene, but it is a deliberate change to the contribution flow, so it is a maintainer call.
• The current CI does not functionally test /scripts. The vale job lints the content folders (docs/, introduction/, contributor/, …), and CodeQL is a security scan. The npm dependency updates Dependabot opens land in /scripts, which has no test or lint coverage, so "checks green" mainly means the docs linter passed and CodeQL found nothing - it does not prove the scripts still run. Scoping auto-merge to patch and minor only (as this workflow does) is the practical safeguard, since those are the updates least likely to break behavior. Adding even a minimal /scripts smoke test later would strengthen the gate.

Scope choice

Patch + minor auto-merge, major held for review. To auto-merge all updates including major, remove the if: guard on the final step. To be stricter (patch only), narrow it to version-update:semver-patch.

One thing to confirm on the first run

Workflows triggered by Dependabot get a GITHUB_TOKEN whose scope is controlled by the permissions: block (set to contents: write + pull-requests: write here). If the first real run reports the token lacks permission to approve or merge, the alternatives are a pull_request_target trigger or a dedicated token; this follows GitHub's documented Dependabot pattern, so it should work as-is, but it is worth watching the first time it fires.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EqiXti3H1onRAb3esyV1Dg