The workflow action pins only move when someone notices

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+# gradle and gitsubmodule stay out: bumping the engine pin or a runtime dep
+# needs a device run, and no CI leg does one.
+updates:
+  # Keep the workflow action pins current (they only rot manually otherwise).
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    ignore:
+      # play-publish.yml never runs on a PR, so no check validates this bump.
+      - dependency-name: r0adkll/upload-google-play

.github/workflows/android.yml

@@ -23,6 +23,8 @@ env:
   NDK_VERSION: r27d
   OPENSSL_VERSION: "3.0.15"
 
+# native and assemble are the two required checks. Never give either a job-level `if:`,
+# because a skipped check run counts as success and auto-merge would land on a build that never ran.
 jobs:
   # Native-only: proves recursive submodules (incl. nested coucal), libiconv
   # vendoring, OpenSSL 3.x, and the 64-bit ndk-build. x86_64 needs the coffeecatch

.github/workflows/dependabot-automerge.yml

@@ -0,0 +1,39 @@
+# Auto-merge saves the manual click, but only the two required jobs gate it. A pin those jobs
+# never run, such as actions/download-artifact, merges unexercised.
+name: Dependabot auto-merge
+
+# pull_request_target, because a dependabot pull_request gets a read-only token.
+# Nothing from the PR is checked out or run, so the writable token stays safe.
+on: pull_request_target
+
+concurrency:
+  # On pull_request_target github.ref is the base branch, so keying on it puts every PR in one
+  # group. Any later PR event, human ones included, then cancels an in-flight arming run.
+  group: dependabot-automerge-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  # Both writes are what enabling auto-merge costs: the API call needs the pull
+  # request scope, and the merge it queues needs the contents one.
+  contents: write
+  pull-requests: write
+
+jobs:
+  automerge:
+    name: Arm auto-merge
+    # github.actor is the pusher, not the author, so a dependabot push onto a fork PR can
+    # satisfy it. The head-repo clause is the one that cannot be forged.
+    if: >-
+      github.repository == 'xroche/httrack-android'
+      && github.event.pull_request.user.login == 'dependabot[bot]'
+      && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-24.04
+    steps:
+      # Dependabot's body is a release-notes dump, so give the squash commit a body of its own.
+      - name: Enable auto-merge
+        run: gh pr merge --auto --squash --subject "$PR_TITLE (#$PR_NUMBER)" --body "" "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}