chore: automerge Dependabot PRs on passing checks

[Copilot]

• Explore repo structure and existing workflows
• Create .github/dependabot.yml to enable weekly Dependabot updates for npm and GitHub Actions
• Create .github/workflows/dependabot-automerge.yml workflow to auto-merge Dependabot PRs when all checks pass
• Run code review and security checks
• Apply prettier formatting

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Automerge Dependabot PRs</issue_title>
<issue_description>When dependabot opens a PR which passes all checks it should be merged automatically. This removes an unnecessary human review and ensure updates happen rapidly. </issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Automerge Dependabot PRs #38

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[don-petry]

@copilot - apply prettier. Always apply prettier on every commit.

[Copilot]

@copilot - apply prettier. Always apply prettier on every commit.

Applied prettier in b4504b1 — single quotes replacing double quotes in dependabot.yml (the automerge workflow was already formatted correctly).

[Copilot]

Pull request overview

Adds Dependabot configuration and a GitHub Actions workflow to automatically enable auto-merge for eligible Dependabot PRs, supporting faster dependency hygiene for this repo.

Changes:

• Add .github/dependabot.yml to enable weekly updates for npm and GitHub Actions.
• Add a Dependabot auto-merge workflow that enables auto-merge for semver patch/minor Dependabot PRs via gh pr merge --auto.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/dependabot-automerge.yml	Enables auto-merge for Dependabot PRs (patch/minor) using fetch-metadata + gh pr merge --auto.
.github/dependabot.yml	Configures weekly Dependabot updates for npm and GitHub Actions.

[Copilot]

permissions are set to contents: write and pull-requests: write at the workflow level, which grants a write-scoped GITHUB_TOKEN for every PR event (even though the job later gates on github.actor). To follow least-privilege, set the workflow-level permissions to read-only (or omit them) and move the write permissions down to the jobs.dependabot.permissions (or the specific step) so they’re only granted when needed.

Suggested change

	contents: write
	pull-requests: write
	jobs:
	dependabot:
	runs-on: ubuntu-latest
	contents: read
	pull-requests: read
	jobs:
	dependabot:
	runs-on: ubuntu-latest
	permissions:
	contents: write
	pull-requests: write

[Copilot]

This workflow triggers on every pull_request to any branch. Other workflows in this repo scope PR workflows to main; consider switching to on: pull_request: branches: [main] (and using the expanded on: mapping style) to avoid unnecessary runs and keep workflow triggers consistent across the repo.

Suggested change

	on: pull_request
	on:
	pull_request:
	branches:
	- main