ci: drop the approval step from Dependabot auto-merge

Branch protection no longer requires an approving review -- passing status checks
are the gate -- so auto-merge is satisfied by a green CI on its own and nothing
needs to approve anything.

This also keeps the repository aligned with GitHub's guidance that workflows should
not be granted permission to approve pull requests. can_approve_pull_request_reviews
stays false.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: TheStreamCode

.github/workflows/dependabot-auto-merge.yml

@@ -1,20 +1,24 @@
 name: Dependabot auto-merge
 
-# Approves and auto-merges Dependabot's patch and minor updates once the required
-# checks pass. Major bumps are deliberately excluded: they are the ones that break
-# builds and deserve a human read.
+# Enables auto-merge on Dependabot's patch and minor updates. GitHub then merges
+# them once the branch protection checks pass — a red build never lands.
 #
-# Why pull_request_target and not pull_request: GitHub treats Dependabot runs as if
-# they came from a fork, so on `pull_request` the GITHUB_TOKEN is read-only and
-# cannot approve or merge. `pull_request_target` runs in the base repository's
-# context with a writable token.
+# Major bumps are deliberately excluded: they are the ones that break builds, and
+# they stay open for a human to read.
 #
-# That trigger is dangerous when a workflow checks out and executes the pull
-# request's code, because untrusted code would then run with those elevated
-# permissions. This workflow never checks out the PR — it only reads metadata and
-# calls the API — so that risk does not apply here.
+# No step approves anything. The branch protection on these repositories requires
+# passing status checks but not an approving review, so auto-merge is satisfied by
+# a green CI alone. That is the point: GitHub documents restricting workflows from
+# approving pull requests as a security best practice, and a bot approving its own
+# dependency bumps would be oversight in name only.
 #
-# Auto-merge waits for the branch protection checks; nothing lands on a red build.
+# Why pull_request_target and not pull_request: GitHub treats Dependabot runs as if
+# they came from a fork, so on `pull_request` the GITHUB_TOKEN is read-only and
+# cannot enable auto-merge. `pull_request_target` runs in the base repository's
+# context with a writable token. That trigger is dangerous when a workflow checks
+# out and runs the pull request's code, because untrusted code would inherit those
+# permissions — this workflow never checks out the PR, it only reads metadata and
+# calls the API.
 
 on: pull_request_target
 
@@ -24,8 +28,8 @@ permissions:
 
 jobs:
   auto-merge:
-    # Verify the author, not just the actor, so the job cannot be driven by a PR
-    # someone else opened.
+    # Check the author rather than the actor, so the job cannot be driven by a
+    # pull request someone else opened.
     if: github.event.pull_request.user.login == 'dependabot[bot]'
     runs-on: ubuntu-latest
 
@@ -34,18 +38,16 @@ jobs:
         id: meta
         uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
 
-      - name: Approve and enable auto-merge for patch and minor updates
+      - name: Enable auto-merge for patch and minor updates
         if: |
           steps.meta.outputs.update-type == 'version-update:semver-patch' ||
           steps.meta.outputs.update-type == 'version-update:semver-minor'
-        run: |
-          gh pr review --approve "$PR_URL"
-          gh pr merge --auto --squash "$PR_URL"
+        run: gh pr merge --auto --squash "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Flag major updates for manual review
+      - name: Leave major updates for manual review
         if: steps.meta.outputs.update-type == 'version-update:semver-major'
         run: |
           echo "::notice::Major update (${{ steps.meta.outputs.dependency-names }}) left for manual review."