Fix Dependabot auto-merge by using pull_request_target for elevated permissions

[Copilot]

• Investigate the auto-merge failure
• Identify root cause: GITHUB_TOKEN lacks permission when triggered by Dependabot PRs
• Research GitHub documentation
• Determine solution: Use pull_request_target for elevated permissions
• Implement fix: Change trigger from pull_request to pull_request_target
• Add better error handling and documentation
• Document the solution and alternative approaches
• Address all code review feedback
• Remove auto-approval step (approval now requires manual human review)
• Add set -o pipefail for proper error detection
• Constrain trigger types to avoid running on irrelevant events
• Explicitly specify bash shell for pipefail compatibility
• Test the fix on an actual Dependabot PR (waiting for next Dependabot PR)
• Verify auto-merge works correctly with manual approval

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[greenc-FNAL]

@phlexbot markdown-fix

[greenc-FNAL]

@copilot Project lead is uncomfortable with auto-approve at this time, and would like to preserve approval as a manual step for now, with auto-merge taking place after human approval and all checks have passed. Please remove the auto-approval step.

[Copilot]

Pull request overview

Updates the Dependabot auto-merge automation to reliably enable auto-merge on protected branches by switching the workflow to pull_request_target, adding an auto-approval step, and documenting the security rationale and alternatives.

Changes:

• Switch workflow trigger from pull_request to pull_request_target for elevated GITHUB_TOKEN permissions on Dependabot PRs.
• Add an “Approve Dependabot PR” step to satisfy approval-based branch protection requirements.
• Add dedicated documentation describing behavior, security considerations, and alternatives (GitHub App / PAT).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/dependabot-auto-merge.yaml	Moves to pull_request_target, adds auto-approval, and refines error handling for enabling auto-merge.
.github/DEPENDABOT_AUTO_MERGE.md	Documents the workflow design, security rationale, and alternative approaches.

Comments suppressed due to low confidence (1)

.github/DEPENDABOT_AUTO_MERGE.md:132

• The file currently ends with a trailing blank line. Please remove the extra blank line so the file ends with exactly one newline after the last content line.

- [Dependabot fetch-metadata action](https://github.com/dependabot/fetch-metadata)

[Copilot]

@copilot Project lead is uncomfortable with auto-approve at this time, and would like to preserve approval as a manual step for now, with auto-merge taking place after human approval and all checks ha...

Removed the auto-approval step in commit fcf19a8. The workflow now only enables auto-merge; approval must be done manually. Auto-merge will trigger after human approval and all CI checks pass.

[greenc-FNAL]

@phlexbot format

[github-actions]

No automatic markdownlint fixes were necessary.

[github-actions]

No automatic cmake-format fixes were necessary.

[greenc-FNAL]

@copilot Please address remaining relevant Copilot review comments.

[github-actions]

No automatic jsonnetfmt fixes were necessary.

[github-actions]

No automatic clang-format fixes were necessary.

[Copilot]

@copilot Please address remaining relevant Copilot review comments.

Addressed both review comments in commit 3dd61c0:

• Added set -o pipefail to ensure gh pr merge exit code is properly captured
• Constrained trigger types: pull_request_target: [opened, reopened, synchronize] and pull_request_review: [submitted] to avoid running on irrelevant events