auto-merge-deps.yml

# Auto-approve and auto-merge dependency PRs (dependabot[bot], renovate[bot]).
#
# All logic lives in the shared reusable workflow
# netresearch/.github/.github/workflows/auto-merge-deps.yml. This file has ZERO
# step-level `uses:` — the single job is a `uses:` of that reusable.
#
# The former third arm (github-actions[bot] + label 'autorelease: pending',
# i.e. release-please) is REMOVED, not reimplemented in the shared workflow.
# Its approve step was a no-op by construction (skipped for that very author,
# deferring to an APPROVE_TOKEN path that never existed); its merge half ran
# for exactly one PR in this repo's history (#466, 2026-02-16). Releases are
# cut by pushing a signed v* tag via release.when-tagged.yml. See
# netresearch/.github#261. Reviving release-please here means re-adding
# auto-merge for it explicitly.
#
# `merge-strategy: rebase` is REQUIRED here. The reusable auto-detects the
# strategy squash-first, but this repo has squash merges disabled
# (allow_squash_merge=false, allow_merge_commit=true, allow_rebase_merge=true),
# so the detector would fall through to `--merge`. The inline job this file
# replaces ran `gh pr merge --auto --rebase`; the pin preserves that.
#
# SECURITY: This workflow uses pull_request_target, which runs with base branch
# permissions. The reusable only runs gh-CLI review/merge steps gated on
# dependabot/renovate authorship — it never checks out or executes PR head code.

name: Auto-merge dependency PRs

on: # zizmor: ignore[dangerous-triggers]
    pull_request_target:

permissions: {}

jobs:
    auto-merge:
        uses: netresearch/.github/.github/workflows/auto-merge-deps.yml@main
        permissions:
            contents: write
            pull-requests: write
        with:
            merge-strategy: rebase