Resync ci_dependabot_automerge.yml with the canonical template (guidance#15)

[blytkerchan]

Summary

• Copies .github/workflows/ci_dependabot_automerge.yml verbatim from vln-devsecops/guidance@main, byte-identical.
• Pulls in guidance#15 (re-checks the PR head SHA before merging so a run never enables auto-merge for a commit it didn't gate; drops GITHUB_TOKEN to read-only since every write already uses the PAT) and guidance#16 (gates on github.event.pull_request.user.login instead of github.actor so the job doesn't silently no-op on reopened; refuses PRs carrying non-Dependabot commits; fails closed instead of merging unguarded when no check ever appears).
• No hand-merging: the file is a straight copy, per runbooks/dependabot-automerge.md in guidance.

Verification

Ran guidance's tests/automerge_gate_test.sh (unmodified) against this repo's copy of the workflow — 11/11 passing:

• template/policy checks: PAT opt-in enforced, no GITHUB_TOKEN write scope
• gate behaviour: all-pass, a-failure, a-cancellation, a-still-running sibling, failure on a paginated API response, a sibling that never completes
• the two regressions this gate exists to prevent: the job's own in-progress check run doesn't self-block, and a late-registering sibling is still caught (the node-dashboard#37 shape)
• no-siblings-at-all is refused (fail closed) rather than merged unguarded

DEPENDABOT_AUTOMERGE_TOKEN is already provisioned on this repo, so these changes take effect on merge. This repo has one other PR-triggered workflow (ci_validate_jekyll.yml) for the gate to wait on.

Closes #20.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates the repository’s Dependabot auto-merge workflow to match the canonical vln-devsecops/guidance@main template, incorporating recent hardening changes (guidance#15/#16) for safer gating and reduced token scope under pull_request_target.

Changes:

• Reduces GITHUB_TOKEN permissions to read-only and documents the security rationale for pull_request_target.
• Fixes gating logic to key off the PR author (github.event.pull_request.user.login) rather than the triggering actor, avoiding silent no-ops on events like reopened.
• Hardens merge safety by failing closed when no sibling checks appear, re-checking PR head SHA before enabling auto-merge, and refusing PRs containing non-Dependabot-authored commits.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.