From af071094ecbe08c555947bead80589b0b380a499 Mon Sep 17 00:00:00 2001
From: "x.qntx.eth" <gitctrlx@gmail.com>
Date: Tue, 1 Sep 2026 12:34:44 +0800
Subject: [PATCH] fix(ci): Dependabot checks:read

---
 .github/workflows/dependabot.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/dependabot.yml b/.github/workflows/dependabot.yml
index 075d71d..22c0f6a 100644
--- a/.github/workflows/dependabot.yml
+++ b/.github/workflows/dependabot.yml
@@ -1,6 +1,7 @@
 # Caller owns on:. Pin at @v2.
-# schedule: squash-merge Dependabot PRs whose checks are green.
-# workflow_dispatch: same sweep. Do not checkout the PR. Does not approve.
+# schedule / workflow_dispatch squash-merge green Dependabot PRs.
+# Public cron is */15 * * * *. Private callers use 0 */6 * * *.
+# Do not checkout the PR. Does not approve.
 name: Dependabot
 
 on:
@@ -11,10 +12,14 @@ on:
 permissions:
   contents: write
   pull-requests: write
+  checks: read
+  actions: read
 
 jobs:
   merge:
     permissions:
       contents: write
       pull-requests: write
+      checks: read
+      actions: read
     uses: qntx/workflows/.github/workflows/ops-dependabot.yml@v2