Add Dependabot auto-merge workflow

[Copilot]

Mirrors the functionality from USTC-KnowledgeComputingLab/ds#318: automatically merge Dependabot PRs once all required status checks pass.

Changes

• New workflow .github/workflows/dependabot.yml: triggers on pull_request, gates on github.actor == 'dependabot[bot]', and enables GitHub's native auto-merge via gh pr merge --auto --squash — the actual merge only fires after all required checks pass

jobs:
  dependabot:
    runs-on: ubuntu-latest
    if: github.actor == 'dependabot[bot]'
    steps:
      - name: auto-merge
        run: gh pr merge --auto --squash "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Requires contents: write and pull-requests: write permissions. Style follows existing workflows in this repo (on: list notation, same job structure).

[Copilot]

Pull request overview

Adds a GitHub Actions workflow to automatically enable GitHub native auto-merge for Dependabot PRs, so those PRs merge automatically once all required checks pass.

Changes:

• Introduces .github/workflows/dependabot.yml to run on pull_request events.
• Gates the job to Dependabot activity and enables auto-merge via gh pr merge --auto --squash.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The job condition uses github.actor == 'dependabot[bot]', which will stop enabling auto-merge if a non-Dependabot user triggers a pull_request event on a Dependabot PR (e.g., via “Update branch”/rebases that generate a new synchronize event). Consider gating on the PR author instead (e.g., github.event.pull_request.user.login) so the workflow consistently applies to Dependabot-authored PRs regardless of who triggered the latest event.

Suggested change

	if: github.actor == 'dependabot[bot]'
	if: github.event.pull_request.user.login == 'dependabot[bot]'

[Copilot]

Workflow names in this repo appear to be Title Case (e.g., “Docs”, “Jest”, “Pytest”). To match that convention, consider renaming this workflow from dependabot to something like “Dependabot”.

Suggested change

	name: dependabot
	name: Dependabot