ci: least-privilege top-level permissions on dependabot-automerge

[calltelemetry-jason]

Adds a top-level permissions: {} to the Dependabot auto-merge workflow so the default token grant for the workflow is empty; the single job keeps its explicit contents: write / pull-requests: write. Addresses the CodeRabbit least-privilege nitpick and keeps the workflow identical across all hardened repos.

[coderabbitai]

Warning

Review limit reached

@calltelemetry-jason, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 5 minutes and 47 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 41c99baf-8f04-42f9-8e79-57716fdc1516

📥 Commits

Reviewing files that changed from the base of the PR and between 1924224 and a85c481.

📒 Files selected for processing (1)

• .github/workflows/dependabot-automerge.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/automerge-least-privilege

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Adds an empty top-level permissions: {} to the Dependabot auto-merge workflow to enforce least-privilege defaults, while the job retains its explicit contents: write and pull-requests: write scopes.

Changes:

• Add permissions: {} at the workflow top level.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.