Add Dependabot auto-merge workflow

[Marenz]

Summary

• Add GitHub workflow to automatically approve and merge Dependabot PRs
• Uses merge method for clean commit history

[Copilot]

Pull Request Overview

This PR adds a GitHub Actions workflow to automate the approval and merging of Dependabot pull requests, streamlining dependency updates with a merge commit strategy.

Key Changes:

• New automated workflow for Dependabot PRs with approval and merge functionality
• Configured to use merge commits for maintaining explicit dependency update history

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

The action ad/dependabot-auto-approve@v1 only approves PRs but does not merge them, despite its use in a step named 'Auto-merge'. To both approve and merge, consider using fastify/github-action-merge-dependabot@v3 or add a separate merge step using gh pr merge with the GitHub CLI.

Suggested change

	- name: Auto-merge Dependabot PR
	uses: ad/dependabot-auto-approve@v1
	- name: Auto-approve and merge Dependabot PR
	uses: fastify/github-action-merge-dependabot@v3

[Copilot]

The workflow triggers on all pull_request events without specifying activity types. This means it runs on every PR event (opened, synchronized, reopened, etc.), including those from external forks in public repositories. Add types: [opened] or use pull_request_target with appropriate safeguards to limit when this workflow executes.

Suggested change

	pull_request:
	pull_request:
	types: [opened]

[llucax]

TIL pull_request by default only triggers on opened, reopened and synchronize.

[Copilot]

The merge-method parameter is not supported by the ad/dependabot-auto-approve@v1 action, which only handles approval. This configuration will have no effect. If you want to control the merge method, use an action that actually performs merging or use the GitHub CLI with gh pr merge --merge.

Suggested change

	github-token: ${{ secrets.GITHUB_TOKEN }}
	merge-method: 'merge'
	github-token: ${{ secrets.GITHUB_TOKEN }}

[llucax]

Same as in other PRs, shouldn't this also have other parameters, like auto-merge?