ci(dependabot): use the x2od reusable Dependabot workflow

[dschach]

Summary

This PR replaces the old Dependabot workflow of this repository with a caller of the x2od reusable Dependabot workflow, and updates the Dependabot configuration.

Changes

File	Change
.github/workflows/dependabot-approve-and-auto-merge.yml	Removed
.github/workflows/dependabot-update.yml	New. Calls the x2od reusable workflow 3 times, 1 time for each dependency type.
.github/dependabot.yml	Rewritten to match x2od/.github, with accurate comments. Security updates only: open-pull-requests-limit: 0 stops version update PRs. This repository gets no version update PRs.

New rules

For all 3 dependency types (production, development, and indirect):

• Approve and merge minor and patch updates.
• Approve and merge security updates at all levels, including major.
• Major updates that are not security fixes need a manual review.

For each Dependabot PR, the workflow also puts the package name in the title scope and adds the dependabot label. After a successful merge, it adds the auto-merged label.

The default merge-mode: auto uses GitHub auto-merge if the repository allows it. If not, it waits in the job for the other checks to pass, and then merges with a squash.

Notes for this repository

• None.

Before this works fully

• Optional: add a PAT named DEPENDABOT_TOKEN 2 times in this repository: as a Dependabot secret (Settings > Secrets and variables > Dependabot) and as an Actions secret (> Actions). Runs that Dependabot starts can read only Dependabot secrets. Without the PAT, the workflow uses the GITHUB_TOKEN: the merge does not start other workflows, and security updates are not found. The PAT permissions are listed at the top of the reusable workflow.

Testing

actionlint passes, and the YAML parses. The reusable workflow has its own test suite in x2od/.github.

🤖 Generated with Claude Code