When Dependabot opens a pull request to update third-party action versions, the PR will always need manual intervention because the template file is not updated and the next run of update.php erases the changes to the .github/workflows directory.
Dependabot does support specifying multiple directories, but it's unclear whether
- a file with invalid YAML (which the template is considered) would be updated correctly.
- a file outside of the
.github folder would be updated
If the file must be valid YAML, then the tokens could be changed to be within comments. If the file needs to be inside .github/, perhaps the template could be moved.