From fc826e1e2db1cf8859946fc6cead3569cbb36a82 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20Bujnovsk=C3=BD?=
 <2659269+miakh@users.noreply.github.com>
Date: Tue, 8 Sep 2026 23:53:24 +0200
Subject: [PATCH 1/2] ci: auto-merge compatible Dependabot development updates

---
 .github/dependabot.yml                     |  7 ++++
 .github/workflows/dependabot-automerge.yml | 40 ++++++++++++++++++++++
 README.md                                  |  7 ++++
 3 files changed, 54 insertions(+)
 create mode 100644 .github/workflows/dependabot-automerge.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 042101d..7010d6a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,11 +5,17 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 2
+    # tsup's declaration bundler uses the TypeScript 5 compiler API.
+    # Revisit this together with a declaration-build tooling migration.
+    ignore:
+      - dependency-name: typescript
+        update-types: [version-update:semver-major]
     groups:
       production-dependencies:
         dependency-type: production
       development-dependencies:
         dependency-type: development
+        update-types: [minor, patch]
   - package-ecosystem: github-actions
     directory: /
     schedule:
@@ -17,5 +23,6 @@ updates:
     open-pull-requests-limit: 1
     groups:
       github-actions:
+        update-types: [minor, patch]
         patterns:
           - '*'
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
new file mode 100644
index 0000000..101b73a
--- /dev/null
+++ b/.github/workflows/dependabot-automerge.yml
@@ -0,0 +1,40 @@
+name: Dependabot auto-merge
+
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize, ready_for_review]
+
+permissions: {}
+
+jobs:
+  enable-auto-merge:
+    if: >-
+      github.repository == 'festappnet/banksync' &&
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.base.ref == 'main' &&
+      !github.event.pull_request.draft
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      # Never check out or execute PR code in this privileged workflow.
+      # Default verification rejects PRs containing non-Dependabot commits.
+      - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3
+        id: metadata
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Enable auto-merge for minor and patch development or Actions updates
+        if: >-
+          (steps.metadata.outputs.update-type == 'version-update:semver-minor' ||
+           steps.metadata.outputs.update-type == 'version-update:semver-patch') &&
+          (steps.metadata.outputs.package-ecosystem == 'github-actions' ||
+           (steps.metadata.outputs.package-ecosystem == 'npm_and_yarn' &&
+            steps.metadata.outputs.dependency-type == 'direct:development'))
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          PR_HEAD: ${{ github.event.pull_request.head.sha }}
+        # GitHub enforces all required checks and an up-to-date branch.
+        run: gh pr merge --auto --squash --match-head-commit "$PR_HEAD" "$PR_URL"
diff --git a/README.md b/README.md
index 078b068..6881f85 100644
--- a/README.md
+++ b/README.md
@@ -216,6 +216,13 @@ pnpm pack --dry-run
 builds, and package-export verification. Provider-live tests are intentionally
 outside the default suite and must never use production bank credentials.
 
+Dependabot minor and patch updates for development dependencies and GitHub
+Actions automatically merge after all required checks pass on an up-to-date
+branch. Major updates and production dependency updates require manual review.
+TypeScript major updates are held back until the declaration build supports
+the newer compiler API. The auto-merge workflow reads verified Dependabot
+metadata only; it never checks out or runs pull-request code.
+
 Stable releases are created from protected `v*` tags by GitHub Actions, publish
 to npm through OIDC trusted publishing, and attach the exact same tarball,
 checksum, provenance and SBOM to the GitHub Release.

From 59be35c15d6479ea18be28201517c345ddca40fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20Bujnovsk=C3=BD?=
 <2659269+miakh@users.noreply.github.com>
Date: Tue, 8 Sep 2026 23:54:10 +0200
Subject: [PATCH 2/2] fix: match the GitHub Actions metadata ecosystem
 identifier

---
 .github/workflows/dependabot-automerge.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index 101b73a..bfe8dfe 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -29,7 +29,7 @@ jobs:
         if: >-
           (steps.metadata.outputs.update-type == 'version-update:semver-minor' ||
            steps.metadata.outputs.update-type == 'version-update:semver-patch') &&
-          (steps.metadata.outputs.package-ecosystem == 'github-actions' ||
+          (steps.metadata.outputs.package-ecosystem == 'github_actions' ||
            (steps.metadata.outputs.package-ecosystem == 'npm_and_yarn' &&
             steps.metadata.outputs.dependency-type == 'direct:development'))
         env: