ci(dependabot): group action updates and auto-merge minor/patch

[psimaker]

Group all github-actions bumps into one weekly PR (minor/patch auto-mergeable, majors manual). Add native auto-merge workflow scoped to github-actions minor/patch, gated on dependabot[bot]. Majors, gomod and /notify base images stay on manual review because docker.yml/version-check.yml don't run on pull_request.

CI/Dependabot: Auto-merge GitHub Actions minor/patch updates

Configures Dependabot to group GitHub Actions dependency updates into weekly PRs and automatically merge low-risk changes:

Changes:

• Updated .github/dependabot.yml to split GitHub Actions updates into two groups: actions-minor-patch (auto-mergeable) and actions-major (manual review)
• Introduced cooldown periods across all ecosystems (3–14 days for actions, 7 days for Go modules and Docker) to prevent same-week re-bump churn
• Added .github/workflows/dependabot-auto-merge.yml to enable GitHub native auto-merge (squash strategy) exclusively for GitHub Actions minor/patch PRs via gh pr merge --auto

Scope:
Auto-merge is limited to minor/patch updates because these are exercised by required checks (Go Tests, Notify Tests) that run on pull_request. Major action bumps, Go module updates, and base-image changes remain manual since the checks that would validate them (docker.yml, version-check.yml) do not run on pull_request events.

Gating:
The workflow respects existing branch protection rules—no approval step required, as main's protection enforces status checks rather than reviews.

No impact on user-facing functionality, privacy, security, or background sync behavior.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

This PR refines Dependabot automation by adding cooldown policies to control update PR frequency across Go modules, Docker, and GitHub Actions; implements separate grouping for major vs. minor/patch action updates; and adds a new workflow to automatically squash-merge qualifying GitHub Actions minor/patch version updates.

Changes

Dependency Update Automation

Layer / File(s)	Summary
Update frequency policies for all ecosystems .github/dependabot.yml	Go modules and Docker ecosystem entries gain 7-day cooldown policies. GitHub Actions configuration is reworked to split updates into separate groups by semver tier (major vs. minor/patch) and introduces semver-aware cooldowns: 14 days for major, 3 days for minor/patch, while weekly scheduling remains across all ecosystems.
Auto-merge workflow for minor/patch GitHub Actions updates .github/workflows/dependabot-auto-merge.yml	New workflow triggers on Dependabot pull requests, fetches update metadata via dependabot/fetch-metadata@v3, and conditionally auto-merges (via squash) only GitHub Actions minor and patch version updates from grouped PR branches starting with dependabot/github_actions/.

Estimated Code Review Effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly Related PRs

• psimaker/vaultsync#12: Both PRs modify .github/dependabot.yml to configure Dependabot's weekly update behavior for the same ecosystems (Go modules, GitHub Actions, and Docker).

Poem

🤖 Dependabot tamed with care,
Cooldowns breathe, updates fair,
Groups divide the major shake,
Auto-merge for safety's sake,
CI automation's gentle hand. 🔧

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title follows conventional-commit style with 'ci:' prefix and clearly describes the main changes: grouping GitHub Actions updates and enabling auto-merge for minor/patch versions.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Private Note Leakage	✅ Passed	Changed code (dependabot.yml and dependabot-auto-merge.yml) contains no logging, analytics, diagnostics, or network requests that expose note contents, vault paths, API keys, or other sensitive data.
Bounded Ios Background Work	✅ Passed	PR contains no Swift or iOS background execution code changes—only CI/Dependabot and GitHub Actions workflow configuration. Custom check for bounded iOS background work is not applicable.
Bridge Contract Compatibility	✅ Passed	PR contains only CI/CD configuration changes (.github files); no Go bridge or Swift bridge-service code modifications that would affect bridge contracts.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/dependabot-grouping-automerge

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}