(chore): automate Dependabot updates

[abnegate]

Summary

• Group Composer, GitHub Actions, and Docker updates into one weekly Dependabot pull request, including major updates.
• Add a bot-only gate that approves and requests native squash auto-merge only after the explicit check allowlist succeeds on the exact current head.

Safety

• Validate an open, non-draft pull request authored by dependabot[bot], from a same-repository dependabot/ ref into main.
• Reject missing, pending, skipped, neutral, failed, duplicated, unexpected, wrong-app, and wrong-SHA checks or statuses.
• Bind approval and native auto-merge to the exact commit; the GraphQL request uses expectedHeadOid.
• Do not check out or execute pull-request code and do not consume artifacts or secrets.

Deferred repository settings

• After this workflow is merged and proven on a Dependabot PR, enable native repository auto-merge (allow_auto_merge=true).

Validation

• actionlint
• Dependabot 2.0 JSON Schema validation
• Exact ecosystem/group assertions
• Negative gate fixtures for missing, skipped, wrong-app, wrong-SHA, and unexpected checks
• composer validate --strict --no-check-publish
• git diff --check

[greptile-apps]

Greptile Summary

Adds weekly grouped Dependabot updates and an exact-head workflow that approves and enables squash auto-merge after an explicit check allowlist succeeds.

• Groups Composer, GitHub Actions, and Docker dependency updates.
• Pins the checkout action and Composer image used by CodeQL.
• Validates Dependabot PR identity, head SHA, checks, and statuses before approval and native auto-merge.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains within the eligible follow-up-review scope.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/dependabot.yml	Configures one weekly multi-ecosystem dependency group covering Composer, GitHub Actions, and Docker updates.
.github/workflows/codeql-analysis.yml	Pins the checkout action and Composer container while preserving the existing CodeQL validation command.
.github/workflows/dependabot-auto-merge.yml	Adds a bot-only, exact-head approval and native squash auto-merge gate with strict check and status validation.

_{Reviews (3): Last reviewed commit: "(fix): stabilize CodeQL dependency check..." | Re-trigger Greptile}