[ChiragAgg5k]

What this adds

• .github/dependabot.yml: weekly (Monday) Dependabot updates for npm and github-actions. Minor and patch version updates are grouped into one PR per ecosystem, and security updates into another. Commits use the chore(deps) conventional prefix.
• .github/workflows/dependabot-auto-merge.yml: on Dependabot PRs, reads the update metadata and enables squash auto-merge only for semver patch and minor updates. Actions are pinned to commit SHAs.
• .github/workflows/ci.yml: the repo had no CI. The build job installs with npm ci on Node 22 and runs npm run build. ng test is left out because the project has no spec files.

Auto-merge policy

Patch and minor updates (including security fixes that are patch or minor) merge automatically once the required checks pass. Major updates are never auto-merged and wait for a human review.

Nothing merges automatically until an admin enables "Allow auto-merge" in the repository settings and adds a ruleset on the default branch requiring the CI check and Hansi.

Required checks

• build
• Hansi

[hansi-codes]

🟢 Tier S · Ready to merge

Adds weekly grouped Dependabot updates for npm and GitHub Actions, plus a workflow intended to enable auto-merge for patch and minor updates. Adds a Node 22 CI workflow that installs dependencies and runs the production build.

Verdict	New comments	Fixed	Still open
✅ Approved	0	0	0

📂 Walkthrough · 3

File	Change
.github/dependabot.yml	Configures weekly npm and GitHub Actions updates, grouped by update type.
.github/workflows/ci.yml	Adds a Node 22 install-and-build check for pull requests and pushes to main.
.github/workflows/dependabot-auto-merge.yml	Reads Dependabot update metadata and attempts to enable squash auto-merge for patch and minor updates.

🔇 Filtered out · 1

Findings Hansi considered but did not post.

Finding

Why

Dependabot's token cannot enable auto-merge

Verifier: The finding mistakes Dependabot's default token permissions for an unchangeable restriction. Dependabot-triggered pull_request workflows can explicitly request write permissions using the permissions block. This workflow already requests contents: write and pull-requests: write at lines 5–7 and passes that GITHUB_TOKEN to gh, matching the supported Dependabot auto-merge pattern. No repository evidence establishes an additional restriction that would reject this command.

---

_{Reviewed 53adf60 · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary