ci: automate compatible Dependabot updates

.github/dependabot.yml

@@ -5,17 +5,24 @@ updates:
     schedule:
       interval: weekly
     open-pull-requests-limit: 2
+    # tsup's declaration bundler uses the TypeScript 5 compiler API.
+    # Revisit this together with a declaration-build tooling migration.
+    ignore:
+      - dependency-name: typescript
+        update-types: [version-update:semver-major]
     groups:
       production-dependencies:
         dependency-type: production
       development-dependencies:
         dependency-type: development
+        update-types: [minor, patch]
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: weekly
     open-pull-requests-limit: 1
     groups:
       github-actions:
+        update-types: [minor, patch]
         patterns:
           - '*'

.github/workflows/dependabot-automerge.yml

@@ -0,0 +1,40 @@
+name: Dependabot auto-merge
+
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize, ready_for_review]
+
+permissions: {}
+
+jobs:
+  enable-auto-merge:
+    if: >-
+      github.repository == 'festappnet/banksync' &&
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.base.ref == 'main' &&
+      !github.event.pull_request.draft
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      # Never check out or execute PR code in this privileged workflow.
+      # Default verification rejects PRs containing non-Dependabot commits.
+      - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3
+        id: metadata
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Enable auto-merge for minor and patch development or Actions updates
+        if: >-
+          (steps.metadata.outputs.update-type == 'version-update:semver-minor' ||
+           steps.metadata.outputs.update-type == 'version-update:semver-patch') &&
+          (steps.metadata.outputs.package-ecosystem == 'github_actions' ||
+           (steps.metadata.outputs.package-ecosystem == 'npm_and_yarn' &&
+            steps.metadata.outputs.dependency-type == 'direct:development'))
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          PR_HEAD: ${{ github.event.pull_request.head.sha }}
+        # GitHub enforces all required checks and an up-to-date branch.
+        run: gh pr merge --auto --squash --match-head-commit "$PR_HEAD" "$PR_URL"

README.md

@@ -216,6 +216,13 @@ pnpm pack --dry-run
 builds, and package-export verification. Provider-live tests are intentionally
 outside the default suite and must never use production bank credentials.
 
+Dependabot minor and patch updates for development dependencies and GitHub
+Actions automatically merge after all required checks pass on an up-to-date
+branch. Major updates and production dependency updates require manual review.
+TypeScript major updates are held back until the declaration build supports
+the newer compiler API. The auto-merge workflow reads verified Dependabot
+metadata only; it never checks out or runs pull-request code.
+
 Stable releases are created from protected `v*` tags by GitHub Actions, publish
 to npm through OIDC trusted publishing, and attach the exact same tarball,
 checksum, provenance and SBOM to the GitHub Release.