Migrate to frequenz-floss dependabot-auto-approve action

[Marenz]

Use commit hash instead of version tag for better security and reproducibility.

[Copilot]

Pull Request Overview

This PR adds a GitHub Actions workflow to automatically merge pull requests created by Dependabot. The workflow triggers on all pull requests, checks if the actor is Dependabot, and uses a third-party action to auto-approve and merge the PR with the 'merge' method.

• Introduces automated Dependabot PR approval and merging
• Uses the frequenz-floss/dependabot-auto-approve action with commit hash pinning
• Grants necessary write permissions for contents and pull requests

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The action name 'dependabot-auto-approve' suggests it only approves PRs, but the workflow is configured to auto-merge them. Consider verifying this action performs both approval and merging as intended, or use GitHub's native auto-merge feature with 'gh pr merge --auto' in a run step instead for more explicit control.

Suggested change

	- name: Auto-merge Dependabot PR
	uses: frequenz-floss/dependabot-auto-approve@005e52004f5d5c6af2f81b89ec25e5cf6f3dfd77 # v1.3.0
	with:
	github-token: ${{ secrets.GITHUB_TOKEN }}
	merge-method: 'merge'
	- name: Checkout repository
	uses: actions/checkout@v4
	- name: Set up GitHub CLI
	uses: actions/setup-gh@v4
	with:
	github-token: ${{ secrets.GITHUB_TOKEN }}
	- name: Approve PR
	run: gh pr review ${{ github.event.pull_request.number }} --approve
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	- name: Auto-merge PR
	run: gh pr merge ${{ github.event.pull_request.number }} --auto --merge
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

[Copilot]

[nitpick] The workflow triggers on all pull_request events without activity type filtering. Consider adding 'types: [opened, reopened, synchronize]' to avoid unnecessary workflow runs on events like 'labeled' or 'assigned'.

Suggested change

	pull_request:
	pull_request:
	types: [opened, reopened, synchronize]

[Copilot]

[nitpick] Using 'merge' creates merge commits for every Dependabot update, which can clutter the git history. Consider using 'squash' or 'rebase' to maintain a cleaner commit history, especially for dependency updates.

Suggested change

	merge-method: 'merge'
	merge-method: 'squash'

The merge-base changed after approval.