(chore): automate Dependabot updates

[abnegate]

Summary

• Group Composer and GitHub Actions updates into one weekly Dependabot pull request, including major updates.
• Add a bot-only gate that approves and requests native squash auto-merge only after the explicit check allowlist succeeds on the exact current head.

Safety

• Validate an open, non-draft pull request authored by dependabot[bot], from a same-repository dependabot/ ref into main.
• Reject missing, pending, skipped, neutral, failed, duplicated, unexpected, wrong-app, and wrong-SHA checks or statuses.
• Bind approval and native auto-merge to the exact commit; the GraphQL request uses expectedHeadOid.
• Do not check out or execute pull-request code and do not consume artifacts or secrets.

Deferred repository settings

• After this workflow is merged and proven on a Dependabot PR, enable native repository auto-merge (allow_auto_merge=true).

Validation

• actionlint
• Dependabot 2.0 JSON Schema validation
• Exact ecosystem/group assertions
• Negative gate fixtures for missing, skipped, wrong-app, wrong-SHA, and unexpected checks
• composer validate --strict --no-check-publish
• git diff --check

[greptile-apps]

Greptile Summary

This PR configures weekly grouped Dependabot updates for Composer and GitHub Actions, then adds an exact-head gate for approving eligible Dependabot pull requests and requesting native squash auto-merge.

• Groups both dependency ecosystems into one weekly update group.
• Validates bot identity, repository and branch boundaries, pull-request state, exact head SHA, and an explicit check/status allowlist.
• Revalidates the head before approval and binds the GraphQL auto-merge request to the expected commit.

Confidence Score: 5/5

The code changes appear safe to merge, with native auto-merge activation intentionally dependent on the deferred repository setting.

The configured dependency ecosystems align with repository manifests and workflows, while the automation avoids executing pull-request code and consistently binds validation, approval, and auto-merge to an eligible same-repository Dependabot pull request at the exact checked commit.

Important Files Changed

Filename	Overview
.github/dependabot.yml	Adds a valid weekly multi-ecosystem group covering the root Composer manifest and GitHub Actions dependencies with wildcard patterns.
.github/workflows/dependabot-auto-merge.yml	Adds a privileged but tightly scoped Dependabot gate that validates identity, exact-head checks and statuses, rechecks head stability, approves the commit, and requests native squash auto-merge.

_{Reviews (1): Last reviewed commit: "(chore): automate Dependabot updates" | Re-trigger Greptile}