chore(deps): bump the python-minor-patch group with 2 updates #6

	name: dependabot-auto-merge

	# Enables GitHub native auto-merge for low-risk Dependabot PRs. `--auto` waits
	# for required status checks to pass before merging, so a bump that breaks CI
	# never lands. Scope: patch and minor only; majors stay manual.
	#
	# Security notes:
	# - Triggers on `pull_request`, NOT `pull_request_target`: this job never
	# checks out or executes the PR's code, only reads metadata and calls the
	# merge API, so it needs no elevated token or secret exposure.
	# - Dependabot-triggered runs get a read-only GITHUB_TOKEN by default; the
	# permissions block below re-grants only what the merge call needs.
	# - The whole job is gated on the dependabot[bot] actor.
	on: pull_request

	permissions:
	contents: write
	pull-requests: write

	jobs:
	auto-merge:
	runs-on: ubuntu-latest
	if: github.actor == 'dependabot[bot]'
	steps:
	- name: Fetch Dependabot metadata
	id: meta
	uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0

	# For grouped PRs, update-type reflects the highest bump in the group, so
	# a group containing a major resolves to semver-major and is left manual.
	- name: Enable auto-merge for patch and minor updates
	if: >-
	steps.meta.outputs.update-type == 'version-update:semver-patch' \|\|
	steps.meta.outputs.update-type == 'version-update:semver-minor'
	run: gh pr merge --auto --squash "$PR_URL"
	env:
	PR_URL: ${{ github.event.pull_request.html_url }}
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Navigation Menu