FIX: Who

Author: larsoner

.github/dependabot.yml

@@ -8,3 +8,7 @@ updates:
       actions:
         patterns:
           - "*"
+    commit-message:
+      prefix: "[dependabot]"
+    cooldown:
+      default-days: 7

.github/workflows/automerge.yml

@@ -1,17 +1,17 @@
 name: Bot auto-merge
-on: pull_request  # yamllint disable-line rule:truthy
+on: pull_request_target  # yamllint disable-line rule:truthy
+
+permissions:
+  contents: write
+  pull-requests: write
 
 jobs:
   autobot:
-    permissions:
-      contents: write
-      pull-requests: write
     runs-on: ubuntu-latest
-    # Names can be found with gh api /repos/mne-tools/mne-python/pulls/12998 -q .user.login for example
-    if: (github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.user.login == 'pre-commit-ci[bot]' || github.event.pull_request.user.login == 'github-actions[bot]') && github.repository == 'mne-tools/mne-realtime'
+    if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'mne-tools/mne-realtime'
     steps:
       - name: Enable auto-merge for bot PRs
         run: gh pr merge --auto --squash "$PR_URL"
         env:
           PR_URL: ${{github.event.pull_request.html_url}}
-          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          GH_TOKEN: ${{secrets.MNE_BOT_TOKEN}}