fix: least-privilege permissions and scope trigger to main in dependabot-automerge workflow

[Copilot]

Addresses two review comments from PR #39 on the Dependabot automerge workflow.

Changes

• Least-privilege permissions: Write permissions (contents, pull-requests) moved from workflow level to job level. Workflow-level is now read-only, limiting the blast radius of the GITHUB_TOKEN for non-Dependabot PR events.
• Scoped trigger: on: pull_request → scoped to branches: [main], consistent with all other workflows in the repo.

# Before
on: pull_request
permissions:
  contents: write
  pull-requests: write
jobs:
  dependabot:
    runs-on: ubuntu-latest

# After
on:
  pull_request:
    branches:
      - main
permissions:
  contents: read
  pull-requests: read
jobs:
  dependabot:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write

Note: bypass merge (no approval required)

This is a GitHub admin setting — not configurable via code. A repo admin must either add dependabot[bot] to the bypass list in the branch ruleset, or reduce required approvals to 0 under Settings → Rules → Rulesets (or Settings → Branches for classic branch protection).

Original prompt

Repository: petry-projects/google-app-scripts

Context

• The user referenced this pull request: chore: automerge Dependabot PRs on passing checks #39
• Task: create a new PR that addresses the review comments from PR chore: automerge Dependabot PRs on passing checks #39.

Requirements

1. Review PR chore: automerge Dependabot PRs on passing checks #39 and identify all review comments / requested changes.
2. Implement code changes to address those comments.
3. Ensure CI/tests (if any) pass.
4. Open a new pull request with the fixes.
   • PR description should summarize the addressed comments and link back to PR chore: automerge Dependabot PRs on passing checks #39.

Additional request (GitHub settings)

• The user asked: “enable bypass merge so that an approval is not needed.”
• If this can be done via repository configuration changes in code (e.g., settings-as-code) within this repo, include those changes.
• If it is an org/repo setting that cannot be changed via code/PR, document clearly in the PR description what needs to be changed in GitHub branch protection / rulesets and who (admin) must do it.

Notes

• Current date: 2026-03-11
• Current user's login: don-petry

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: Create a new PR to address the comments from the original PR. Also, enable bypass merge so that an approval is not needed.

Assistant: We’ve kicked off the request to create a new pull request addressing the feedback from PR #39 and to handle the “no-approval-needed” merge bypass ask, and we’re now waiting on your accept/reject confirmation in the dialog before we can proceed.

This pull request was created from Copilot chat.

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[Copilot]

Pull request overview

Updates the Dependabot auto-merge GitHub Actions workflow to follow least-privilege permissions while keeping the existing auto-merge behavior for Dependabot PRs targeting main.

Changes:

• Restricts the workflow trigger to pull_request events targeting the main branch.
• Reduces default (workflow-level) token permissions to read-only.
• Grants write permissions only to the specific dependabot job that performs the merge.