Enable scheduled Dependabot auto-merge

[arunshenoy99]

Adds the scheduled Dependabot auto-merge caller (mirrors wp-module-mcp), pointing at the shared reusable in newfold-labs/workflows@main.

A twice-daily sweep merges eligible Dependabot PRs (not draft, mergeable, all checks green, patch/minor) using the repo's own GITHUB_TOKEN — no secrets. Majors stay individual for a human.

Updates are intentionally left ungrouped: with auto-merge handling the volume, keeping each update as its own PR means a CI failure is isolated to the exact dependency (and the rest still auto-merge) instead of a grouped batch you'd have to bisect.

Part of PRESS0-4266.

[github-actions]

AI code review

Thanks for aligning this repo with the org-wide Dependabot approach. This is a tight, least-privilege workflow that should reduce noise and keep dependencies current with minimal human intervention.

✅ Strengths

• Principle of least privilege: top-level permissions: {} with job-scoped contents: write, pull-requests: write, and checks: read is spot-on.
• Clear scheduling: twice-daily sweep plus a manual workflow_dispatch with a dry-run input gives both automation and control.
• Good defaults for safety: only patch/minor are auto-merged; majors are left for human review, and merge method is squash.
• Delegation to the central reusable workflow keeps logic DRY and consistent with org standards.

⚠️ Suggestions (non-blocking)

• Pin the reusable workflow ref to a commit SHA or a protected tag instead of @main to reduce supply-chain risk and ensure deterministic runs. If you prefer agility, consider a protected, signed tag and let Dependabot/Renovate update it.
• Minor readability: add parentheses in the dry-run expression for clarity and to avoid any ambiguity about operator precedence, e.g. (${{ github.event_name == 'workflow_dispatch' && inputs.dry-run }}) || false.
• Optional hardening: add a concurrency group (e.g., dependabot-auto-merge) with cancel-in-progress: true to prevent overlapping sweeps if one ever runs long.
• Consider a short note in repo docs (docs/index.md or a CONTRIBUTING section) summarizing the Dependabot grouping and auto-merge policy so contributors know what to expect.

❌ Issues (blocking/critical)

• None found. The only noteworthy risk is the @main ref for the reusable workflow; see suggestion above.

Verdict

⚠️ Verdict: Looks good to merge with minor follow-ups (pin the reusable workflow ref and optional readability/concurrency tweaks).

---

Automation note (for everyone): This AI review is posted as one regular pull-request conversation comment that GitHub Actions updates in place on each successful workflow run (same comment URL). New commits do not “close” an earlier AI edition in the GitHub sense—the text is replaced. This automation does not dismiss or complete formal GitHub Reviews, resolve review threads, or change review-request state; those still require normal GitHub review actions.

[github-actions]

Coverage: Base 33.21% → PR 33.21% (must not decrease).
✅ No decrease.

project coverage report 33.21% @ 4b8c879

[arunshenoy99]

Thanks, but this is a false positive — nothing to change here. Hyphenated inputs work fine with dot notation in Actions expressions (inputs.config-path is GitHub's own reusable-workflow example), and the reusable itself uses inputs.dry-run / inputs.pr-limit the same way. actionlint passes it too. inputs['dry-run'] would also work, but the current form is valid.

(The concurrency suggestion is already handled inside the reusable workflow.)