chore: add PR lifecycle automation

[RocketDelivery2]

Repository settings found

• Repository protection is ruleset-based on main (Protect main), not legacy branch protection.
• Final PR merge method is squash.
• Auto-merge is enabled at the repository level.
• Merged branches are auto-deleted.
• Required approving reviews are set to 0.
• Admins cannot bypass failed required checks silently.

Settings changed

• Added .github/copilot/settings.json with {"mergeStrategy":"merge"} for conflict sync.
• Updated the Protect main ruleset to require the exact checks build and Markdown lint.
• Kept main protected from force-pushes and deletion.
• Kept squash-only merging on main.

Workflows added or modified

• .github/workflows/pr-auto-merge.yml
  • Metadata-only pull_request_target automation for trusted repo-owned PRs to main.
  • Enables squash auto-merge, never checks out PR code, rejects drafts and forks.
• .github/workflows/dependabot-auto-merge.yml
  • Dependabot-only metadata workflow.
  • Auto-approves only minor/patch updates and enables squash auto-merge.

Exact required checks

• build
• Markdown lint

Security boundaries

• No privileged pull_request_target checkout or execution of untrusted code.
• No auto-merge for untrusted forks.
• Minimum token permissions only.
• Dependabot approval is limited to minor/patch updates.
• Major Dependabot updates are not auto-approved.
• Trusted auto-merge is limited to verified repo-owned actors only.

Validation

• YAML/JSON syntax validation: exit 0
• dotnet restore TeamBuilder.slnx: exit 0
• dotnet build TeamBuilder.slnx --configuration Release --no-restore: exit 0
• dotnet test TeamBuilder.slnx --configuration Release --no-build: exit 0
• npx markdownlint-cli2 "**/*.md": exit 0

Limitations

• Auto-approval applies only to trusted repository-owned PRs and qualifying Dependabot updates.
• Fork PRs are intentionally excluded from write-capable automation.
• Auto-merge still waits on the required checks enforced by main.

Rollback

• Revert the automation commit(s) on this branch.
• Disable the two new workflows.
• Restore the previous Protect main ruleset if needed.

[Copilot]

Pull request overview

Adds GitHub automation and settings to streamline PR lifecycle management on main, including enabling auto-merge for trusted contributors and Dependabot updates, plus setting a default Copilot merge strategy.

Changes:

• Add a workflow to enable squash auto-merge for PRs authored by an allowlisted set of users.
• Add a workflow to approve and enable squash auto-merge for eligible Dependabot patch/minor updates.
• Add Copilot repository merge settings.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/pr-auto-merge.yml	Enables squash auto-merge for trusted, same-repo PRs targeting main.
.github/workflows/dependabot-auto-merge.yml	Auto-approves and enables squash auto-merge for Dependabot patch/minor PRs targeting main.
.github/copilot/settings.json	Configures Copilot’s default merge strategy for the repository.

Suppressed comments (1)

.github/workflows/dependabot-auto-merge.yml:112

• auto_merge_enabled is set to enabledAt (a timestamp) or empty, but this script compares it to the literal string "true". As a result, the "already enabled" short-circuit will never trigger, and the workflow may redundantly try to enable auto-merge every run.

          if [[ "$auto_merge_enabled" == "true" ]]; then
            echo "Auto-merge is already enabled." >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi