Automate Dependabot updates

.github/dependabot.yml

@@ -0,0 +1,48 @@
+# Managed by DavidVeksler/dependabot-fleet
+version: 2
+
+updates:
+  - package-ecosystem: "nuget"
+    directories:
+      - "/"
+      - "/CodeContext.Tests"
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "01:25"
+      timezone: "America/Denver"
+    open-pull-requests-limit: 5
+    groups:
+      non-major-updates:
+        applies-to: "version-updates"
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      security-updates:
+        applies-to: "security-updates"
+        patterns:
+          - "*"
+
+  - package-ecosystem: "github-actions"
+    directories:
+      - "/"
+    schedule:
+      interval: "weekly"
+      day: "friday"
+      time: "02:45"
+      timezone: "America/Denver"
+    open-pull-requests-limit: 5
+    groups:
+      non-major-updates:
+        applies-to: "version-updates"
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      security-updates:
+        applies-to: "security-updates"
+        patterns:
+          - "*"

.github/workflows/dependabot-automerge.yml

@@ -0,0 +1,68 @@
+# Managed by DavidVeksler/dependabot-fleet
+name: Dependabot auto-merge
+
+on:
+  pull_request_target:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  dependabot:
+    name: dependabot-auto-merge
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - name: Read Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@d7267f607e9d3fb96fc2fbe83e0af444713e90b7
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+
+      - name: Wait for pull-request CI
+        if: >-
+          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
+          steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        shell: bash
+        run: |
+          stable_passes=0
+          for attempt in {1..120}; do
+            checks="$(gh pr checks "$PR_URL" --json name,bucket 2>/dev/null || echo '[]')"
+            checks="$(jq '[.[] | select(.name != "dependabot-auto-merge")]' <<<"$checks")"
+            count="$(jq 'length' <<<"$checks")"
+            failed="$(jq '[.[] | select(.bucket == "fail" or .bucket == "cancel")] | length' <<<"$checks")"
+            pending="$(jq '[.[] | select(.bucket == "pending")] | length' <<<"$checks")"
+
+            if (( failed > 0 )); then
+              jq -r '.[] | select(.bucket == "fail" or .bucket == "cancel") | "Failed check: \(.name)"' <<<"$checks" >&2
+              exit 1
+            fi
+
+            if (( count > 0 && pending == 0 )); then
+              stable_passes=$((stable_passes + 1))
+              if (( stable_passes >= 3 )); then
+                exit 0
+              fi
+            else
+              stable_passes=0
+            fi
+
+            sleep 10
+          done
+
+          echo "Timed out waiting for successful pull-request CI." >&2
+          exit 1
+        env:
+          GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+          PR_URL: "${{ github.event.pull_request.html_url }}"
+
+      - name: Merge verified non-major update
+        if: >-
+          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
+          steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        run: gh pr merge --merge "$PR_URL"
+        env:
+          GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+          PR_URL: "${{ github.event.pull_request.html_url }}"