fix(ci): repair Dependabot auto-merge workflow

[WomB0ComB0]

Summary

The Auto-merge Dependabot workflow has never successfully merged a PR. Every minor/patch Dependabot PR (#94, #95, #97, #98) stalled in a BLOCKED state, exhausting the open-pull-requests-limit in dependabot.yml and risking missed security updates.

Two distinct root causes, both confirmed in the #97 run log:

1. Broken rebase step — gh pr comment --body "@dependabot rebase" is posted via GITHUB_TOKEN, which Dependabot rejects: "Sorry, only users with push access can use that command." Removed the step; it is unnecessary (gh pr merge --auto queues the merge and Dependabot self-rebases).
2. Repo auto-merge disabled — gh pr merge --auto failed with "GraphQL: Auto merge is not allowed for this repository." The repo-level Allow auto-merge setting has been enabled (allow_auto_merge=true).

Test plan

• Merge this PR.
• Confirm the next Dependabot patch/minor PR auto-merges (or manually trigger by re-running the workflow on an open patch PR).
• Verify the auto-merge job goes green instead of failing.

Follow-ups (not in this PR)

• Major bumps chore(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.1.1 #94 (create-pull-request v7→v8), chore(deps): bump actions/download-artifact from 4.3.0 to 8.0.1 #95 (download-artifact v4→v8), chore(deps): update shlex requirement from 1.3 to 2.0 #98 (shlex 1→2) still need manual review.
• release-plz chore: release #96 still blocked — should merge once mergeability clears.
• Consider enabling delete_branch_on_merge to auto-clean merged Dependabot branches.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Optimized the automated merge workflow for dependency updates to ensure more reliable handling of dependency pull requests through improved merge queuing behavior.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 097ac08d-211e-4cb1-8088-b760ec0a7325

📥 Commits

Reviewing files that changed from the base of the PR and between 8b32462 and b666205.

📒 Files selected for processing (1)

• .github/workflows/auto-merge.yml

---

📝 Walkthrough

Walkthrough

The GitHub Actions auto-merge workflow is simplified by documenting the removal of a @dependabot rebase comment step. The step is no longer needed because GITHUB_TOKEN permissions prevent posting that comment, and the subsequent gh pr merge --auto call already triggers automatic rebasing behavior in Dependabot, making the explicit comment unnecessary.

Changes

GitHub Actions Auto-Merge Workflow

Layer / File(s)	Summary
Auto-merge workflow documentation .github/workflows/auto-merge.yml	Comments are added explaining why the @dependabot rebase comment step is absent: GITHUB_TOKEN lacks permission to post that comment, and gh pr merge --auto already handles rebasing automatically via Dependabot's native behavior.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 A comment removed, but not forgotten—
The workflow now speaks in prose, undrotten.
gh pr merge --auto knows the way,
Dependabot rebase happens anyway! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix(ci): repair Dependabot auto-merge workflow' directly and clearly summarizes the main change: fixing the GitHub Actions workflow that handles automatic merging of Dependabot PRs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/auto-merge-dependabot-workflow

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}