fix(dependabot-merge): approve the PR before merging so the review ruleset allows it

.github/workflows/dependabot-merge.yml

@@ -185,7 +185,7 @@ jobs:
           echo "$PACKAGE $VERSION is $age days old."
           echo "old_enough=true" >> "$GITHUB_OUTPUT"
 
-      - name: Verify latest CI run and squash merge
+      - name: Verify latest CI run, approve and squash merge
         if: >
           steps.pr.outputs.number != '' &&
           steps.update_type.outputs.skip == 'false' &&
@@ -212,5 +212,21 @@ jobs:
             echo "CI was superseded, rerun or is not successful; not auto-merging."
             exit 0
           fi
-          gh pr merge "$PR" --repo "$REPO" --squash --delete-branch \
-            --match-head-commit "$HEAD_SHA"
+          # The org's "Review required" ruleset wants one approval, and
+          # without it the merge below is refused. The approval is pinned to
+          # the commit CI just passed. The ruleset does not dismiss stale
+          # approvals on push, so a failed merge dismisses it: left in place,
+          # it would let a later push merge without a human review.
+          # Needs "Allow GitHub Actions to create and approve pull requests"
+          # in the repo's Actions settings.
+          review_id=$(gh api "/repos/$REPO/pulls/$PR/reviews" \
+            -f commit_id="$HEAD_SHA" -f event=APPROVE \
+            -f body='Stable patch or minor update, CI passed, release old enough.' \
+            --jq .id)
+          if ! gh pr merge "$PR" --repo "$REPO" --squash --delete-branch \
+            --match-head-commit "$HEAD_SHA"; then
+            gh api -X PUT "/repos/$REPO/pulls/$PR/reviews/$review_id/dismissals" \
+              -f message='Auto-merge failed; approval withdrawn.' > /dev/null || \
+              echo "::error::Merge failed and the approval could not be dismissed. Dismiss review $review_id on #$PR by hand."
+            exit 1
+          fi

README.md

@@ -83,8 +83,13 @@ Major, 0.x, prerelease, grouped and unrecognized titles remain manual. The workf
 requires a unique open, nondraft Dependabot PR from the same repository to `main`,
 the exact current head, and a successful latest run and attempt of the triggering
 CI workflow. Actions-only changes require the complete paginated file list,
-including previous paths for renames. Merge uses `--match-head-commit` without
-an administrative bypass.
+including previous paths for renames. The workflow then approves the PR at the
+head CI passed, which the org's "Review required" ruleset needs, and merges with
+`--match-head-commit` without an administrative bypass. If the merge fails, the
+workflow dismisses its approval, because the ruleset keeps approvals after a
+push. The approval needs
+"Allow GitHub Actions to create and approve pull requests" on in the caller
+repository's Actions settings; without it, the workflow fails at the approval.
 
 Two more guards apply to every caller: