(chore): automate Dependabot updates

[abnegate]

Summary

• Group Composer and GitHub Actions updates into one weekly Dependabot pull request, including major updates.
• Add a bot-only gate that approves and requests native squash auto-merge only after the explicit check allowlist succeeds on the exact current head.

Safety

• Validate an open, non-draft pull request authored by dependabot[bot], from a same-repository dependabot/ ref into main.
• Reject missing, pending, skipped, neutral, failed, duplicated, unexpected, wrong-app, and wrong-SHA checks or statuses.
• Bind approval and native auto-merge to the exact commit; the GraphQL request uses expectedHeadOid.
• Do not check out or execute pull-request code and do not consume artifacts or secrets.

Deferred repository settings

• Native repository auto-merge and Actions pull-request approvals are already enabled; no repository setting is changed by this PR.

Validation

• actionlint
• Dependabot 2.0 JSON Schema validation
• Exact ecosystem/group assertions
• Negative gate fixtures for missing, skipped, wrong-app, wrong-SHA, and unexpected checks
• composer validate --strict --no-check-publish
• git diff --check

[greptile-apps]

Greptile Summary

The PR configures weekly grouped Composer and GitHub Actions Dependabot updates and adds a strict exact-head workflow that approves qualifying bot pull requests and enables squash auto-merge.

• Adds a multi-ecosystem Dependabot group for repository-root dependencies.
• Validates Dependabot identity, repository, branch, head SHA, and an exact successful-check allowlist.
• Requests commit-bound approval and native squash auto-merge without checking out pull-request code.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking concurrency race that can occasionally leave an otherwise eligible Dependabot pull request approved without auto-merge enabled.

The identity, exact-head, and check validation are internally consistent, but all check completion events share cancel-in-progress concurrency even though most are later rejected by the job condition, creating an interruptible gap between the two write operations.

Files Needing Attention: .github/workflows/dependabot-auto-merge.yml

Important Files Changed

Filename	Overview
.github/dependabot.yml	Adds a coherent weekly multi-ecosystem update group for the repository's Composer manifest and GitHub Actions workflows.
.github/workflows/dependabot-auto-merge.yml	Adds a strongly validated auto-merge gate, but workflow-level cancellation can interrupt an eligible run when an irrelevant check event arrives.

Prompt To Fix All With AI

### Issue 1
.github/workflows/dependabot-auto-merge.yml:21-23
**Irrelevant events cancel the gate**

If a non-Greptile check completion is delivered while an eligible run is between approval and the auto-merge request, the shared `cancel-in-progress` group cancels that run even though the new event is rejected by the job condition, leaving the pull request approved without auto-merge enabled.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "(chore): automate Dependabot updates" | Re-trigger Greptile}

[greptile-apps]

Irrelevant events cancel the gate

If a non-Greptile check completion is delivered while an eligible run is between approval and the auto-merge request, the shared cancel-in-progress group cancels that run even though the new event is rejected by the job condition, leaving the pull request approved without auto-merge enabled.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/dependabot-auto-merge.yml
Line: 21-23

Comment:
**Irrelevant events cancel the gate**

If a non-Greptile check completion is delivered while an eligible run is between approval and the auto-merge request, the shared `cancel-in-progress` group cancels that run even though the new event is rejected by the job condition, leaving the pull request approved without auto-merge enabled.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.