ci: automate dependabot minor/patch updates

[SuperCoolPencil]

Sets up auto-merge for dependabot PRs targeting minor and patch versions. Note: you still need to enable Allow auto-merge in the repository settings for this to work.

Greptile Summary

Adds a GitHub Actions workflow that:

• Runs for Dependabot-authored pull requests.
• Reads Dependabot update metadata.
• Attempts to enable merge-commit auto-merge for minor and patch updates.

Confidence Score: 2/5

This PR should not merge until the workflow uses an event or trusted follow-up design that can actually enable auto-merge for Dependabot pull requests.

Dependabot-triggered pull-request runs receive a read-only token, while the workflow's core command requires pull-request write access, so eligible updates will fail instead of being enrolled in auto-merge; the mutable privileged action reference also warrants hardening.

Files Needing Attention: .github/workflows/dependabot-auto-merge.yml

Security Review

The workflow passes a write-capable token to an action referenced by a mutable major-version tag; pin the action to an immutable commit SHA.

T-Rex Logs

What T-Rex did

• • T-Rex ran the requested verification, but its local artifact references were not uploaded.
• • T-Rex collected and attached validation artifacts for the dependabot-auto-merge scenario, including the before-state log, after-state log, GitHub context log, and the gate-validation harness.
• • The after-state evidence shows YAML parse passes and the configured command was invoked for patch/minor while major updates were skipped.
• • The GitHub context log records the credentials/context blocker that prevented progress, clarifying the blocking condition.
• • The generated gate-validation Ruby harness was produced to enable executable validation.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
.github/workflows/dependabot-auto-merge.yml	Adds Dependabot auto-merge automation, but the selected event supplies insufficient privileges for its merge command and the privileged action is not immutably pinned.

Prompt To Fix All With AI

Fix the following 2 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 2
.github/workflows/dependabot-auto-merge.yml:2
**Dependabot token blocks auto-merge**

When Dependabot opens a minor or patch update, this `pull_request` workflow invokes `gh pr merge` with a read-only event token, causing the command to fail with insufficient permissions and leaving auto-merge disabled.

### Issue 2 of 2
.github/workflows/dependabot-auto-merge.yml:15
**Mutable action receives write token**

The mutable `dependabot/fetch-metadata@v2` reference receives a token with content and pull-request write permissions, so a compromised or repointed tag can modify repository content or pull requests. Pin the action to a reviewed full commit SHA.

_{Reviews (1): Last reviewed commit: "ci: add dependabot auto-merge workflow" | Re-trigger Greptile}

Greptile also left 2 inline comments on this PR.

[greptile-apps]

Dependabot token blocks auto-merge

When Dependabot opens a minor or patch update, this pull_request workflow invokes gh pr merge with a read-only event token, causing the command to fail with insufficient permissions and leaving auto-merge disabled.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/dependabot-auto-merge.yml
Line: 2

Comment:
**Dependabot token blocks auto-merge**

When Dependabot opens a minor or patch update, this `pull_request` workflow invokes `gh pr merge` with a read-only event token, causing the command to fail with insufficient permissions and leaving auto-merge disabled.

How can I resolve this? If you propose a fix, please make it concise.

[greptile-apps]

Mutable action receives write token

The mutable dependabot/fetch-metadata@v2 reference receives a token with content and pull-request write permissions, so a compromised or repointed tag can modify repository content or pull requests. Pin the action to a reviewed full commit SHA.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/dependabot-auto-merge.yml
Line: 15

Comment:
**Mutable action receives write token**

The mutable `dependabot/fetch-metadata@v2` reference receives a token with content and pull-request write permissions, so a compromised or repointed tag can modify repository content or pull requests. Pin the action to a reviewed full commit SHA.

How can I resolve this? If you propose a fix, please make it concise.