ci: add Dependabot grouping and auto-merge for patch/minor (#59)

Co-authored-by: Kael (OpenClaw) <kael@openclaw>
Co-authored-by: Kael <kael@openclaw.ai>
Co-authored-by: Kael <kael@openclaw.dev>

Author: 4 people

.github/dependabot.yml

@@ -1,6 +1,5 @@
 version: 2
 updates:
-  # Keep npm dependencies up to date
   - package-ecosystem: 'npm'
     directory: '/'
     schedule:
@@ -10,8 +9,18 @@ updates:
     commit-message:
       prefix: 'build'
       include: 'scope'
+    groups:
+      npm-minor:
+        patterns:
+          - '*'
+        update-types:
+          - 'minor'
+      npm-patch:
+        patterns:
+          - '*'
+        update-types:
+          - 'patch'
 
-  # Keep GitHub Actions up to date
   - package-ecosystem: 'github-actions'
     directory: '/'
     schedule:
@@ -21,3 +30,14 @@ updates:
     commit-message:
       prefix: 'ci'
       include: 'scope'
+    groups:
+      github-actions-minor:
+        patterns:
+          - '*'
+        update-types:
+          - 'minor'
+      github-actions-patch:
+        patterns:
+          - '*'
+        update-types:
+          - 'patch'

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,22 @@
+name: Auto-merge Dependabot PRs
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+
+# Requires "Allow auto-merge" enabled in repository settings.
+permissions: {}
+
+# Concurrency is handled by the reusable workflow.
+jobs:
+  auto-merge:
+    # Expected actor for Dependabot PRs. If auto-merges stop firing, verify
+    # this value hasn't changed: https://docs.github.com/en/code-security/dependabot
+    if: github.actor == 'dependabot[bot]'
+    permissions:
+      contents: write
+      pull-requests: write
+    # Reusable workflow from benhigham/.github (pinned to SHA below).
+    # For the source of the pinned version, check the repo at the matching commit.
+    # Latest version: https://github.com/benhigham/.github/blob/main/.github/workflows/auto-merge-dependabot.yml
+    uses: benhigham/.github/.github/workflows/auto-merge-dependabot.yml@0ec9301fc776a5b328077294c3e98ba35cf5baef