ci: add scheduled Dependabot auto-merge caller (PRESS0-4266)

[arunshenoy99]

What

Adds .github/workflows/dependabot-auto-merge.yml, a thin caller that delegates to the org-wide reusable sweep at newfold-labs/workflows/.github/workflows/reusable-dependabot-auto-merge.yml@main.

Why

Part of the fleet-wide scheduled Dependabot auto-merge rollout (PRESS0-4266). Twice-daily, the reusable finds every open Dependabot PR and merges the eligible ones — not draft, mergeable, all check runs green, and an opted-in bump type (patch, minor). Major bumps are left for a human to review.

Notes

• Config-only: adds a single workflow file, no source changes.
• The AI-code-review Dependabot skip is already merged in this repo, so reviews won't block auto-merge (a skipped job counts as passing).
• No change to dependabot.yml — updates stay ungrouped so a single bad bump never blocks the rest.
• Scheduled workflows fire from the default branch (main), which is where this caller lands.
• Manual workflow_dispatch supports a dry-run input to preview what would be merged.

[github-actions]

AI code review

✅ Strengths

• Clear, minimal caller that delegates to the org-wide reusable — keeps logic centralized and consistent across repos.
• Principle of least privilege: top-level permissions: {} with explicit job-level contents: write, pull-requests: write, and checks: read is solid.
• Reasonable schedule (twice daily) with good in-file documentation; merge-method: squash and update-types: patch,minor align with the rollout intent.
• Includes a workflow_dispatch with a dry-run input to enable safe previews.

❌ Issues (blocking)

• The dry-run expression references the wrong context and uses an invalid key accessor for a hyphenated input name. In workflow_dispatch the input should be read from github.event.inputs['dry-run'] (bracket notation required for hyphenated keys). As written, inputs.dry-run is undefined and likely causes the manual dry-run to always evaluate to false (or error), defeating the advertised preview capability.
  • Suggested fix:
    • Minimal: dry-run: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs['dry-run'] == 'true' || false }}
    • More robust boolean coercion: dry-run: ${{ github.event_name == 'workflow_dispatch' && fromJSON(github.event.inputs['dry-run'] || 'false') || false }}

⚠️ Suggestions (non-blocking)

• Pin the reusable workflow ref instead of @main to avoid unexpected behavior if the central workflow changes. Prefer a stable tag (e.g., @v1) or a specific commit SHA.
• Add a concurrency group to avoid overlapping runs between scheduled and manual dispatches (e.g., at workflow level):
  • concurrency: { group: dependabot-auto-merge, cancel-in-progress: true }
• Optional: Note the UTC timezone in the schedule comment for clarity for maintainers in other regions.

✅ Testing notes

• After fixing the dry-run expression, trigger a manual run with dry-run: true and confirm logs show intended merges without performing them. Then run dry-run: false (or wait for the next schedule) on a known eligible Dependabot PR to validate end-to-end behavior.

⚠️ Verdict: request changes

The workflow is well-structured and secure, but the dry-run expression bug breaks the advertised manual preview capability. Please fix that expression; pinning the reusable ref and adding concurrency would be nice follow-ups but are non-blocking.