[dschach]

Summary

This PR replaces the old Dependabot workflow of this repository with a caller of the x2od reusable Dependabot workflow, and updates the Dependabot configuration.

Changes

File	Change
.github/workflows/dependabot-approve-and-auto-merge.yml	Removed
.github/workflows/dependabot-update.yml	New. Calls the x2od reusable workflow 3 times, 1 time for each dependency type.
.github/dependabot.yml	Rewritten to match x2od/.github, with accurate comments. Keeps Dependabot version update PRs, and security update PRs.

New rules

For all 3 dependency types (production, development, and indirect):

• Approve and merge minor and patch updates.
• Approve and merge security updates at all levels, including major.
• Major updates that are not security fixes need a manual review.

For each Dependabot PR, the workflow also puts the package name in the title scope and adds the dependabot label. After a successful merge, it adds the auto-merged label.

This repository is private on a free plan, so GitHub auto-merge is not available. The default merge-mode: auto waits in the job for the other checks to pass, and then merges with a squash.

Notes for this repository

• Drops include: scope; the workflow now sets the scope.
• "Allow GitHub Actions to create and approve pull requests" is off, and there is no PAT, so the approval step will fail until one of them is fixed.

Before this works fully

• Optional: add a PAT named DEPENDABOT_TOKEN 2 times in this repository: as a Dependabot secret (Settings > Secrets and variables > Dependabot) and as an Actions secret (> Actions). Runs that Dependabot starts can read only Dependabot secrets. Without the PAT, the workflow uses the GITHUB_TOKEN: the merge does not start other workflows, and security updates are not found. The PAT permissions are listed at the top of the reusable workflow.

---

Generated by Claude Code