From becc9da4a0728f3991ed5acc224547a8b56e4b85 Mon Sep 17 00:00:00 2001
From: nicodes <nicozessoules@gmail.com>
Date: Mon, 3 Aug 2026 15:08:51 -0600
Subject: [PATCH] Automate safe Dependabot updates

---
 .github/dependabot.yml           | 11 +++++++----
 .github/workflows/dependabot.yml | 31 +++++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+), 4 deletions(-)
 create mode 100644 .github/workflows/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ff02179..b154457 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,9 +6,9 @@
 # has gone stale -- a tag at least reads as a version. This is the thing that
 # tells you.
 #
-# Grouped into one pull request rather than one per action. These are all the
-# same kind of change, and a pin bump arriving alone every few days is how pin
-# bumps stop being read at all.
+# Minor and patch updates are grouped: they share the same risk profile and CI
+# can merge them without ceremony. Major updates are deliberately excluded, so
+# Dependabot opens one reviewable pull request for each breaking-change boundary.
 version: 2
 updates:
   - package-ecosystem: github-actions
@@ -16,6 +16,9 @@ updates:
     schedule:
       interval: weekly
     groups:
-      actions:
+      actions-minor-patch:
         patterns:
           - "*"
+        update-types:
+          - minor
+          - patch
diff --git a/.github/workflows/dependabot.yml b/.github/workflows/dependabot.yml
new file mode 100644
index 0000000..157be10
--- /dev/null
+++ b/.github/workflows/dependabot.yml
@@ -0,0 +1,31 @@
+name: Dependabot
+
+# Dependabot's minor and patch action updates are grouped in dependabot.yml.
+# Once the required CI check passes, this marks only those low-risk updates for
+# squash merge. Major updates never satisfy the condition and remain manual.
+on:
+  pull_request:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Read Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Enable auto-merge for minor and patch updates
+        if: >-
+          steps.metadata.outputs.update-type == 'version-update:semver-minor' ||
+          steps.metadata.outputs.update-type == 'version-update:semver-patch'
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}