ci: auto-approve major Dependabot updates (#275)

* ci: auto-approve major Dependabot updates

Remove the semver-patch/minor guards so the bot approves and enables
auto-merge for all Dependabot PRs, including major version bumps. With 2
required reviewers, the bot approval still leaves a human review gate
before auto-merge completes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci: drop now-unused Dependabot metadata step

The fetch-metadata step only existed to gate on update-type; with the
semver guards removed, nothing references it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci: also gate auto-merge on the event actor

pull_request.user.login is the PR author and stays dependabot[bot] for
the PR's lifetime, so a human pushing commits to a Dependabot branch
would otherwise trigger an auto-approval of their own changes. Require
github.actor to be dependabot[bot] as well.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ksroda-sa

.github/workflows/dependabot-auto-merge.yml

@@ -9,27 +9,17 @@ permissions:
 jobs:
   auto-merge:
     runs-on: ubuntu-latest
-    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    if: >-
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      github.actor == 'dependabot[bot]'
     steps:
-      - name: Fetch Dependabot metadata
-        id: metadata
-        uses: dependabot/fetch-metadata@v3
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
       - name: Approve PR
-        # Auto-merge patch + minor updates across all samples (RN iOS is now
-        # covered by test-ios.yml's `pod install` + `xcodebuild build`).
-        if: |
-          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
-          steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        # Auto-approve all updates (patch/minor/major) across all samples.
         run: gh pr review --approve "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GH_TOKEN: ${{ secrets.GH_SERVICE_ACCOUNT_DEVOPS_2_PAT1 }}
       - name: Enable auto-merge
-        if: |
-          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
-          steps.metadata.outputs.update-type == 'version-update:semver-minor'
         run: gh pr merge --auto --squash "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}