feat: auto approve dependabot PRs

Author: mishraomp

.gitattributes

@@ -0,0 +1,8 @@
+# Autodetect text files and forces unix eols, so Windows does not break them
+* text=auto eol=lf
+
+# Force images/fonts to be handled as binaries
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.png binary

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,33 @@
+name: Dependabot Auto Merge
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - synchronize
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: dependabot-auto-merge-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  auto-approve-and-merge:
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Approve Dependabot PR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: gh pr review --approve "$PR_URL"
+
+      - name: Enable auto-merge for Dependabot PRs
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: gh pr merge --auto "$PR_URL"

.yamllint

@@ -0,0 +1,37 @@
+# yamllint config for this repo.
+#
+# Scope: today only `make lint` points yamllint at .github/workflows, so this
+# config is tuned for GitHub Actions workflow files. If we add more YAML to the
+# repo, revisit the rules below.
+#
+# Indent policy: 2 spaces, matching the rest of the codebase (ruff also runs at
+# indent-width = 2). Sequences ("- step") indent consistently under their key.
+extends: default
+
+rules:
+  indentation:
+    spaces: 2
+    indent-sequences: consistent
+    check-multi-line-strings: false
+
+  # GitHub Actions uses `on:` as a mapping key. YAML 1.1 treats on/off/yes/no
+  # as booleans, which would otherwise trigger truthy warnings. Whitelist `on`
+  # so the rest of the truthy rule (catching stray `yes`/`no` values) still
+  # protects us.
+  truthy:
+    allowed-values: ["true", "false", "on"]
+
+  # Workflow `if:` expressions and `run:` one-liners frequently exceed any
+  # sensible line-length cap.
+  line-length: disable
+
+  # Workflow files don't carry a `---` document marker.
+  document-start: disable
+
+  # Inline `# v1.2.3` comments after action SHAs are intentional pinning notes;
+  # don't require them to align with surrounding content.
+  comments-indentation: disable
+
+  comments:
+    require-starting-space: true
+    min-spaces-from-content: 1

Makefile

@@ -18,9 +18,12 @@ test:
 format:
 	uv run ruff format .
 
-# Lint all Python: style, imports, docstrings, and bug-prone patterns.
+# Lint all Python: style, imports, docstrings, and bug-prone patterns. Also
+# lints the GitHub Actions workflow YAML (2-space indent enforced; see
+# .yamllint at the repo root).
 lint:
 	uv run ruff check .
+	uv run yamllint .github/workflows
 
 # Dry-run the npm package for every publishable skill (CI does the real publish
 # on merge). Only the root skills/ tree publishes; the .github/skills/ meta-skills

pyproject.toml

@@ -11,6 +11,7 @@ dependencies = [
 dev = [
     "pytest>=9.0.3",
     "ruff>=0.15.16",
+    "yamllint>=1.37.1",
 ]
 
 [tool.uv]