(chore): automate Dependabot updates

[abnegate]

Summary

• Group Composer and GitHub Actions updates into one weekly Dependabot pull request, including major updates.
• Add a bot-only gate that approves and requests native squash auto-merge only after the explicit check allowlist succeeds on the exact current head.

Safety

• Validate an open, non-draft pull request authored by dependabot[bot], from a same-repository dependabot/ ref into main.
• Reject missing, pending, skipped, neutral, failed, duplicated, unexpected, wrong-app, and wrong-SHA checks or statuses.
• Bind approval and native auto-merge to the exact commit; the GraphQL request uses expectedHeadOid.
• Do not check out or execute pull-request code and do not consume artifacts or secrets.

Deferred repository settings

• After this workflow is merged and proven on a Dependabot PR, enable native repository auto-merge (allow_auto_merge=true).

Validation

• actionlint
• Dependabot 2.0 JSON Schema validation
• Exact ecosystem/group assertions
• Negative gate fixtures for missing, skipped, wrong-app, wrong-SHA, and unexpected checks
• composer validate --strict --no-check-publish
• git diff --check

[greptile-apps]

Greptile Summary

Adds weekly grouped Dependabot updates and a strict exact-head automation gate for bot-authored updates.

• Groups Composer and GitHub Actions dependencies into one weekly multi-ecosystem update.
• Requires an exact allowlist of successful checks and no legacy statuses.
• Revalidates Dependabot identity and head SHA before approval and native squash auto-merge.

Confidence Score: 5/5

The PR appears safe to merge, with repository auto-merge enablement intentionally deferred until the workflow is proven.

The configured check names match the repository’s current workflow jobs, and the gate fails closed while binding every approval and merge request to the validated Dependabot head.

Important Files Changed

Filename	Overview
.github/dependabot.yml	Adds a valid weekly multi-ecosystem Dependabot group covering Composer and GitHub Actions dependencies.
.github/workflows/dependabot-auto-merge.yml	Adds a conservative bot-only gate that validates PR identity, exact head, checks, and statuses before commit-bound approval and native auto-merge.

_{Reviews (1): Last reviewed commit: "(chore): automate Dependabot updates" | Re-trigger Greptile}