ci: group Dependabot minor and patch updates and queue auto-merge

[imran-siddique]

69 of the 92 open PRs across agentrust-io are Dependabot's, one per package. This groups minor and patch updates into one PR per ecosystem per week, which is two to four a week per repo.

• .github/dependabot.yml: a catch-all minor/patch group on each pip and github-actions entry, replacing the narrower codeql-action group. Majors still arrive one at a time. Docker digest entries are unchanged.
• .github/workflows/dependabot-auto-merge.yml: runs gh pr merge --auto --squash on Dependabot PRs. It approves nothing. A maintainer still approves the head commit, and gate plus the branch rules still apply. Once that happens and CI is green, GitHub merges without anyone coming back to click.

🤖 Generated with Claude Code

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[noah-ing]

Reviewed d878f6f. Thanks for keeping this focused. The same-repository bot guard, quoted URL, and absence of a checkout in the privileged job look good.

One thing to line up before enabling auto-merge: in the branch-rule snapshot I checked, main requires only gate, which checks current-head maintainer approval but not CI results. gh pr checks 756 --required and the effective branch rules both show that. Once the approval requirements are met, the six test jobs can still be pending or failing without blocking automatic merging.

Could we require the test matrix checks before enabling this, or use a required aggregate that explicitly fails unless its dependencies succeed? The grouping change could land separately if the settings update needs to follow later. Requiring the existing governance job alone would not cover this, since it can be skipped when test fails.

Two small cleanups while updating: please add the DCO sign-off required by CONTRIBUTING.md, and adjust the Python-major wording—the retained pip rule ignores majors rather than opening them individually.

Validation: actionlint 1.7.12 passed (ShellCheck disabled); 19 local checks covered the actual guard expression, quoted shell command with a fake CLI, grouping preservation, and gate script with mocked API responses. This was not a live auto-merge test; the new bot-only job is skipped on this PR.

[carloshvp]

Reviewed exact head d878f6f252a4e0f945c3d0441457909e572dcd00 in an isolated checkout.

Required repository-policy correction: CONTRIBUTING.md, Developer certificate of origin requires a Signed-off-by trailer on every commit. d878f6f252a4e0f945c3d0441457909e572dcd00 have none. Please add the author's DCO sign-off to each commit; the Co-Authored-By trailer does not provide that certification.

Validation: 26 checks against the actual workflow and Dependabot configuration. The eligibility guard admits same-repository dependabot[bot] PRs and rejects human, spoofed-name and fork controls. The workflow checks out no PR content, passes the URL through the environment and only queues squash auto-merge; it grants no approval or administrator bypass. The catch-all groups contain only minor/patch updates; existing schedules, directories, limits, ignore rules and Docker digest/minor policy are unchanged. Actionlint v1.7.12, diff checks and a clean merge simulation passed.

The repository release-validation permission suite passed: 12 tests, including OIDC drift controls.

Live main-branch rules require independent code-owner/current-push approval, resolved review threads and the maintainer gate; repository auto-merge is enabled. I did not dispatch or claim a live Dependabot merge: the first eligible event still needs operational observation. Only the gate is currently a required status check, so other CI failures still need maintainer attention before approval.

Requesting changes only for the missing required DCO sign-off; I found no blocking defect in the workflow/configuration changes reviewed.