feat(ci): auto-approve Dependabot patch-level bumps

[rusackas]

SUMMARY

Adds a workflow that auto-approves Dependabot PRs bumping a dependency by a patch version only, using dependabot/fetch-metadata's update-type output. Minor and major bumps get no automated review — normal human review as today.

This was originally suggested as "gate auto-approve/auto-merge on patch-level bumps." I checked before building anything, and auto-merge doesn't hold up as suggested — see below. What's in this PR is the auto-approve half only, scoped down deliberately.

Why not auto-merge too

• allow_auto_merge is false at the repo level (confirmed via the API) — GitHub's native auto-merge is switched off repo-wide. Enabling it is a separate, repo-wide settings decision (affects every PR, not just Dependabot's) that this workflow doesn't make on its own.
• Branch protection (.asf.yaml) requires require_code_owner_reviews: true plus 1 approving review. I checked .github/CODEOWNERS against every path Dependabot actually opens PRs against (superset-frontend/, docs/, superset-websocket/ ×2, and pip at /) — none match any CODEOWNERS pattern, so a bot-posted approval satisfies the plain 1-approval requirement for those, the same way GitHub's own documented fetch-metadata + gh pr review --approve recipe works for repos with required reviews. One exception: the npm ecosystem scoped to .github/actions matches the /.github/ CODEOWNERS entry — those PRs will still need a real human owner's approval no matter what this workflow does. It posts a review there too (harmless), but it won't satisfy the code-owner requirement alone.

So: for most of the actual Dependabot PR volume, this should get the review requirement out of the way before a human ever opens the PR, but merging is still a manual click same as today — auto-merge would need someone to deliberately flip the repo setting, which felt like a decision for a maintainer to make explicitly rather than something to bundle into this PR.

Trigger choice

Uses a plain pull_request trigger (types: opened, synchronize), not pull_request_target. I'd assumed Dependabot-triggered pull_request events get a read-only token regardless of the permissions: block (a real, commonly-cited GitHub Actions restriction) and almost built this around pull_request_target to work around it — but this repo's own sync-requirements-for-python-dep-upgrade-pr.yml already does a git push (needs contents: write) under a plain pull_request trigger for genuine Dependabot PRs, and I checked its actual run history/logs to confirm that push step succeeds today. Copied that same proven trigger/guard convention here instead of assuming the more complex trigger was necessary.

Allowlist status

dependabot/fetch-metadata@25dd0e34... (the exact SHA pinned here) is already on ASF Infra's action allowlist — checked apache/infrastructure-actions' approved_patterns.yml directly rather than assume. No Infra ticket needed for this PR to run.

TESTING INSTRUCTIONS

1. Watch the next patch-level Dependabot PR (any of the npm/pip ecosystems except .github/actions) and confirm it picks up an approving review automatically.
2. Confirm a minor/major bump PR gets no automated review.
3. Confirm a patch bump under the .github/actions npm scope still shows as needing review (the bot's approval alone shouldn't satisfy the code-owner gate there).

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
• Introduces new feature or API
• Removes existing feature or API

🤖 Generated with Claude Code

[bito-code-review]

Bito Automatic Review Skipped - Files Excluded

Bito didn't auto-review this change because all changed files are in the exclusion list for automatic reviews. No action is needed if you didn't intend for the agent to review it. Otherwise, to manually trigger a review, type /review in a comment and save.
You can change the excluded files settings here, or contact your Bito workspace admin at evan@preset.io.

[rusackas]

Let's make it npm only if possible