[arzafran]

What & why

Dependabot auto-merge has never merged anything. Every eligible bump passes the checks, reaches gh pr merge, and GitHub refuses it with "the base branch policy prohibits the merge": the org's "Review required" ruleset wants one approval and the workflow never gives one. charge-cars-website alone has 23 failed runs, and its bumps piled up until someone merged them by hand. Every repo that calls this workflow has the same problem.

The workflow now approves the PR right before merging, after every existing check has passed (CI green on the latest run, stable patch or minor bump, release old enough). The approval goes through the reviews API with commit_id set to the head CI ran on, so a commit pushed afterwards is never approved, and the merge keeps --match-head-commit.

The org ruleset doesn't dismiss stale approvals on push (checked in all 8 callers). So if the merge fails after approving, the workflow dismisses its own approval and fails the job; otherwise the approval would stay and a later push could merge without a human review. If the dismissal itself is refused, the job logs an error naming the review to dismiss by hand.

The approval needs "Allow GitHub Actions to create and approve pull requests". It is on in all 8 repos that call this workflow (charge-cars-website, curiosus-website, fluid-simulation, lenis-showcase-admin, oss-website, satus, the-gauge, x-website). The README now says so.

How to verify

1. Read a failed run in charge-cars-website, for example https://github.com/darkroomengineering/charge-cars-website/actions/runs/41929828507: the merge step fails with "the base branch policy prohibits the merge".
2. After this merges, bump the pinned SHA in a caller (charge-cars-website's automerge-dependabot.yml). The next eligible Dependabot PR should get a github-actions approval and then merge.
3. actionlint .github/workflows/dependabot-merge.yml reports only the existing SC2129 style note on the update-type step. The new lines add nothing.

Checklist

• PR is focused on a single logical change
• Linked the related issue: CLI-448
• Lint/format/tests pass locally (actionlint)
• Updated docs/types where relevant (README, "Dependabot merge policy")