From 88b3c51035b2c36d376c5180bbaa6f6e3b50b7d6 Mon Sep 17 00:00:00 2001
From: Alies Lapatsin <5278175+alies-dev@users.noreply.github.com>
Date: Wed, 28 Oct 2026 15:37:13 +0100
Subject: [PATCH] ci: auto-merge non-major Dependabot PRs #0

The cron job using AnandChowdhary/dependabot-pr-action@master never merged
anything, so patch bumps piled up. Replace it with dependabot/fetch-metadata
and merge every non-major Dependabot PR as soon as it opens or is rebased.

Disable Renovate here: Dependabot security updates already cover the same
vulnerabilities, so every alert produced two PRs.
---
 .github/renovate.json                         |  4 +---
 .github/workflows/auto_update_npm_updates.yml | 16 -------------
 .github/workflows/dependabot_auto_merge.yml   | 24 +++++++++++++++++++
 3 files changed, 25 insertions(+), 19 deletions(-)
 delete mode 100644 .github/workflows/auto_update_npm_updates.yml
 create mode 100644 .github/workflows/dependabot_auto_merge.yml

diff --git a/.github/renovate.json b/.github/renovate.json
index 699bd59..a97dc86 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -1,6 +1,4 @@
 {
     "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-    "extends": [
-        "local>InteractionDesignFoundation/.github:renovate-config-security-updates-only"
-    ]
+    "enabled": false
 }
diff --git a/.github/workflows/auto_update_npm_updates.yml b/.github/workflows/auto_update_npm_updates.yml
deleted file mode 100644
index 632e96b..0000000
--- a/.github/workflows/auto_update_npm_updates.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-name: NPM PRs auto-merge
-
-on:
-  schedule:
-    - cron: "0 12 * * *"
-
-jobs:
-  merge:
-    name: "Auto-merge patch updates"
-    runs-on: ubuntu-latest
-    steps:
-      - uses: AnandChowdhary/dependabot-pr-action@master
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          merge-minor: false
-          merge-patch: true
diff --git a/.github/workflows/dependabot_auto_merge.yml b/.github/workflows/dependabot_auto_merge.yml
new file mode 100644
index 0000000..5ae4017
--- /dev/null
+++ b/.github/workflows/dependabot_auto_merge.yml
@@ -0,0 +1,24 @@
+name: Dependabot auto-merge
+
+on: pull_request
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    name: "Merge non-major updates"
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    steps:
+      - id: metadata
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - if: steps.metadata.outputs.update-type != 'version-update:semver-major'
+        run: gh pr merge --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}