[miguelcolmenares]

⚠️ Do not merge until WEB-1194 makes this repository private. SilverAssist/workflows is private, and GitHub only shares a private repository's actions with other private repositories. Merged while this repository is public, the caller fails on every Dependabot pull request.

Summary

Dependabot pull requests go through the shared SilverAssist/workflows/dependabot-auto-merge@v1 action. .github/workflows/auto-merge-dependabot.yml is a thin caller: the trigger, the dependabot[bot] guard and the job permissions. The action holds majors, applies the release-age cooldown (3 days patch, 7 days minor, dated by Packagist's published-time), refuses pull requests with commits that are not verified Dependabot commits, then approves the evaluated commit as github-actions[bot] and runs gh pr merge --auto --match-head-commit.

Changes

• Adds the caller.
• Adds .github/dependabot.yml (this repository had none): Composer and GitHub Actions, weekly, minor and patch grouped. Composer reads the private vcs packages through the silverassist-github registry, whose password is the Dependabot secret COMPOSER_GITHUB_TOKEN. That secret does not exist here yet and must be set before merging.
• CHANGELOG entry under [Unreleased].

Repository settings already applied

• Allow auto-merge on.
• The main-protection ruleset requires Quality Checks (PHP 8.2), Quality Checks (PHP 8.3), Quality Checks (PHP 8.4).

Verified

The same caller merged a Dependabot pull request unattended in agents-toolkit (#129) and held three majors (#130 to #132). It runs in the 14 npm repositories.