Fix Dependabot auto-merge without repository auto-merge setting.

The workflow failed because the repository has allow_auto_merge disabled and
main requires linear history, so gh pr merge --auto --merge could never succeed.

Approve patch and minor Dependabot PRs on pull_request_target, then squash
merge them after CI completes via workflow_run once branch rules are satisfied.

Co-authored-by: Jan Willem Kaper <kapersoft@users.noreply.github.com>

Author: cursoragent

.github/workflows/dependabot-auto-merge.yml

@@ -2,34 +2,101 @@ name: dependabot-auto-merge
 
 on:
   pull_request_target:
+    types: [opened, synchronize, reopened]
     branches:
       - main
+  workflow_run:
+    workflows:
+      - Pest tests
+      - PHPStan
+      - Pint
+      - Rector
+      - Composer Normalize
+    types:
+      - completed
+
+concurrency:
+  group: dependabot-auto-merge-${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.event.pull_request.head.sha }}
+  cancel-in-progress: false
 
 permissions:
   contents: write
   pull-requests: write
+  actions: read
 
 jobs:
-  dependabot:
+  approve:
+    name: Approve Dependabot PR
     runs-on: ubuntu-latest
-    if: github.actor == 'dependabot[bot]'
+    if: >
+      github.event_name == 'pull_request_target' &&
+      github.actor == 'dependabot[bot]'
     steps:
       - name: Dependabot metadata
         id: metadata
         uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
         with:
           github-token: ${{ github.token }}
 
-      - name: Auto-merge Dependabot PRs for semver-minor updates
-        if: steps.metadata.outputs.update-type == 'version-update:semver-minor'
-        run: gh pr merge --auto --merge "$PR_URL"
+      - name: Approve patch and minor updates
+        if: |
+          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
+          steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        run: gh pr review --approve "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GH_TOKEN: ${{ github.token }}
 
-      - name: Auto-merge Dependabot PRs for semver-patch updates
-        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
-        run: gh pr merge --auto --merge "$PR_URL"
+  merge:
+    name: Merge Dependabot PR
+    runs-on: ubuntu-latest
+    if: >
+      github.event_name == 'workflow_run' &&
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'pull_request'
+    steps:
+      - name: Find pull request
+        id: pr
         env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
           GH_TOKEN: ${{ github.token }}
+        run: |
+          PR_NUMBER=$(gh api \
+            "repos/${{ github.repository }}/commits/${{ github.event.workflow_run.head_sha }}/pulls" \
+            --jq 'first(.[].number) // empty')
+
+          if [ -z "$PR_NUMBER" ]; then
+            echo "No pull request found for this workflow run."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          AUTHOR=$(gh pr view "$PR_NUMBER" --json author -q '.author.login')
+          if [ "$AUTHOR" != "app/dependabot" ] && [ "$AUTHOR" != "dependabot[bot]" ]; then
+            echo "Pull request #$PR_NUMBER is not from Dependabot."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+          echo "number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
+
+      - name: Squash merge when checks and review requirements are satisfied
+        if: steps.pr.outputs.skip == 'false'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ steps.pr.outputs.number }}
+        run: |
+          MERGE_STATE=$(gh pr view "$PR_NUMBER" --json mergeStateStatus -q '.mergeStateStatus')
+
+          if [ "$MERGE_STATE" != "CLEAN" ]; then
+            echo "Pull request #$PR_NUMBER is not ready to merge (status: $MERGE_STATE)."
+            exit 0
+          fi
+
+          REVIEW=$(gh pr view "$PR_NUMBER" --json reviewDecision -q '.reviewDecision')
+          if [ "$REVIEW" != "APPROVED" ]; then
+            echo "Pull request #$PR_NUMBER is not approved (decision: $REVIEW)."
+            exit 0
+          fi
+
+          gh pr merge "$PR_NUMBER" --squash