Add migration step to update auto-dependabot

We remove the fine-grained update for ubuntu-slim from a previous step
because now we are just replacing the whole file.

Signed-off-by: Leandro Lucarella <luca-frequenz@llucax.com>

Author: llucax

cookiecutter/migrate.py

@@ -43,6 +43,9 @@ def main() -> None:
     print("Migrating pyproject license metadata to SPDX format...")
     migrate_pyproject_license()
     print("=" * 72)
+    print("Migrating auto-dependabot workflow to use GitHub App token...")
+    migrate_auto_dependabot_token()
+    print("=" * 72)
     print()
 
     if _manual_steps:
@@ -119,21 +122,6 @@ def migrate_to_ubuntu_slim() -> None:
                 "new": '    needs: ["create-github-release"]\n    runs-on: ubuntu-slim',
             },
         ],
-        "auto-dependabot.yaml": [
-            {
-                "job": "auto-merge",
-                "old": (
-                    "  auto-merge:\n"
-                    "    if: github.actor == 'dependabot[bot]'\n"
-                    "    runs-on: ubuntu-latest"
-                ),
-                "new": (
-                    "  auto-merge:\n"
-                    "    if: github.actor == 'dependabot[bot]'\n"
-                    "    runs-on: ubuntu-slim"
-                ),
-            }
-        ],
         "release-notes-check.yml": [
             {
                 "job": "check-release-notes",
@@ -298,6 +286,76 @@ def migrate_pyproject_license() -> None:  # pylint: disable=too-many-branches
     print("  Updated pyproject.toml: migrated license metadata")
 
 
+def migrate_auto_dependabot_token() -> None:
+    """Migrate auto-dependabot workflow to use a GitHub App installation token.
+
+    This replaces the GITHUB_TOKEN with a GitHub App installation token to
+    ensure that auto-merge and merge queue events are properly triggered.
+    Using GITHUB_TOKEN suppresses subsequent workflow runs (by design), which
+    prevents merge queue CI from running and can cause auto-merge to silently
+    fail.
+
+    This migration intentionally overwrites `.github/workflows/auto-dependabot.yaml`
+    with the template version, as the workflow is small and user customizations
+    are not supported.
+    """
+    filepath = Path(".github") / "workflows" / "auto-dependabot.yaml"
+    # This is separated only to avoid flake8 errors about line length
+    dependabot_auto_approve_version = (
+        "3cad5f42e79296505473325ac6636be897c8b8a1 # v1.3.2"
+    )
+    desired_content = (
+        r"""name: Auto-merge Dependabot PR
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-slim
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        with:
+          app-id: ${{ secrets.FREQUENZ_AUTO_DEPENDABOT_APP_ID }}
+          private-key: ${{ secrets.FREQUENZ_AUTO_DEPENDABOT_APP_PRIVATE_KEY }}
+
+      - name: Auto-merge Dependabot PR
+        uses: frequenz-floss/dependabot-auto-approve@"""
+        + dependabot_auto_approve_version
+        + r"""
+        with:
+          github-token: ${{ steps.app-token.outputs.token }}
+          dependency-type: 'all'
+          auto-merge: 'true'
+          merge-method: 'merge'
+          add-label: 'tool:auto-merged'
+"""
+    )
+
+    if filepath.exists():
+        content = filepath.read_text(encoding="utf-8").replace("\r\n", "\n")
+        if content == desired_content:
+            print(f"  Skipped {filepath}: already up to date")
+            return
+
+        print(
+            f"  Replacing {filepath} with updated workflow (overwriting any local changes)"
+        )
+        replace_file_atomically(filepath, desired_content)
+        return
+
+    filepath.parent.mkdir(parents=True, exist_ok=True)
+    replace_file_atomically(filepath, desired_content)
+    print(f"  Added {filepath}: installed updated workflow")
+
+
 def read_project_type() -> str | None:
     """Read the cookiecutter project type from the replay file."""
     replay_path = Path(".cookiecutter-replay.json")