Add Dependabot auto-merge workflow

[Marenz]

Adds automatic approval and merging of Dependabot PRs using the frequenz-floss/[email protected] action.

[Copilot]

Pull Request Overview

This PR adds a GitHub Actions workflow to automatically approve and merge Dependabot pull requests. The workflow is triggered on pull requests created by the Dependabot bot and uses a third-party action to handle the auto-approval and merging process.

• Introduces automated Dependabot PR handling
• Configures merge method as "merge" (non-squash)
• Uses frequenz-floss/[email protected] action

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Using secrets.GITHUB_TOKEN with auto-merge for Dependabot PRs bypasses code review and CI checks. Consider adding conditions to verify that CI checks have passed before auto-merging, or restrict auto-merge to patch/minor updates only to reduce risk of breaking changes being merged automatically.

Suggested change

	steps:
	- name: Auto-approve and merge Dependabot PRs
	steps:
	- name: Wait for required status checks
	uses: actions/github-script@v6
	id: check-status
	with:
	github-token: ${{ secrets.GITHUB_TOKEN }}
	script: |
	const pr = await github.rest.pulls.get({
	owner: context.repo.owner,
	repo: context.repo.repo,
	pull_number: context.issue.number,
	});
	const sha = pr.data.head.sha;
	const checks = await github.rest.checks.listForRef({
	owner: context.repo.owner,
	repo: context.repo.repo,
	ref: sha,
	});
	const failed = checks.data.check_runs.filter(
	c => c.status === "completed" && c.conclusion !== "success"
	);
	if (failed.length > 0) {
	core.setFailed("Some required status checks have not passed.");
	}
	- name: Auto-approve and merge Dependabot PRs
	if: steps.check-status.outcome == 'success'

[Copilot]

The workflow triggers on all pull_request events but only processes Dependabot PRs. Consider using pull_request_target event with type filters like [opened, synchronize, reopened] to better control when this workflow runs, or add types to the pull_request trigger to avoid unnecessary workflow executions.

Suggested change

	pull_request:
	pull_request:
	types: [opened, synchronize, reopened]