ci: auto-merge Dependabot PRs after CI passes

Mirrors the etherpad-org house rule: trust CI for major bumps,
don't semver-filter. The workflow waits for the lint-typecheck-test
and e2e jobs to succeed, then enables auto-merge with squash.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: JohnMcLear

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,25 @@
+name: Dependabot auto-merge
+on: pull_request_target
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - name: Wait for CI to succeed
+        uses: lewagon/wait-on-check-action@v1.4.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          wait-interval: 30
+          allowed-conclusions: success,skipped
+          check-regexp: '^(lint-typecheck-test|e2e)$'
+      - name: Enable auto-merge
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

AGENTS.md

@@ -49,6 +49,12 @@ After main-process source changes, **restart `pnpm dev`** — Vite HMR only cove
 - Commits: conventional style (`feat(scope): …`, `fix(scope): …`, `test(e2e): …`, `docs(scope): …`).
 - Push to `origin/feat/linux-mvp` after every fix or feature commit. Don't batch.
 
+## CI / Dependabot
+
+- Dependabot is configured for npm and GitHub Actions deps (`.github/dependabot.yml`).
+- Dependabot PRs auto-merge once CI passes (`.github/workflows/dependabot-auto-merge.yml`). No semver filter — trust CI for major bumps too; CI gates breakage.
+- The auto-merge workflow waits for `lint-typecheck-test` and `e2e` jobs using `lewagon/wait-on-check-action`, then enables squash auto-merge via `gh pr merge --auto --squash`.
+
 ## House rules
 
 - Match the spec at `docs/superpowers/specs/2026-05-03-etherpad-desktop-linux-mvp-design.md` and the plan at `docs/superpowers/plans/2026-05-03-etherpad-desktop-linux-mvp.md`.