[siracusa5]

What

A workflow that queues GitHub's native auto-merge (gh pr merge --auto --squash) for Dependabot PRs that are patch or minor updates. Major updates get the needs-manual-review label and wait for a human.

Settings changed outside this PR

• New ruleset main: require CI: the required check must pass before anything lands on main. Org admins can bypass. The existing protect main ruleset is untouched.
• Repo setting "Allow auto-merge" is on.
• New label needs-manual-review.

The required job aggregates engine, engine-windows, console, site, desktop and desktop-linux, and it passed on Dependabot PR #206. A Dependabot PR that fails CI stays open.

Things to know

• The workflow checks the PR author (pull_request.user.login), not github.actor, which can be spoofed by commenting on a fork PR. It uses pull_request, not pull_request_target, and pins dependabot/fetch-metadata to a commit SHA.
• An auto-merge does not start push workflows. Merges made with GITHUB_TOKEN run no push-triggered workflows (in harness-kit, 12 bot merges ran 0 and 2 human merges ran 3 each). So site-deploy.yml, console-preview.yml and the push run of ci.yml skip these merges, and a bump reaches production with the next push to main that touches the same app. The desktop app only releases from a tag either way.
• The DCO check exempts verified bot commits, so Dependabot PRs still pass sign-off.
• Pairs with chore(deps): merge npm Dependabot entries and add cooldown #209, which groups the npm updates and adds a 7-day cooldown. Either can merge first.

Test plan

• Workflow YAML parses; the deploy and release triggers above were read from the workflow files
• Same workflow shape has run on grouped Dependabot PRs in harness-kit (#428, #432, #433, #436)
• After merge, the next Dependabot patch or minor PR gets auto-merge enabled and merges once required is green
• After merge, the next major PR gets the label and stays open

🤖 Generated with Claude Code