From 736066e8915f4cfec655166ff25c48443e0c2434 Mon Sep 17 00:00:00 2001
From: SyniRon <66834451+SyniRon@users.noreply.github.com>
Date: Mon, 27 Jul 2026 16:54:36 -0400
Subject: [PATCH] chore(ci): add CODEOWNERS and Dependabot auto-merge (#243)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Repository protection moved from classic branch protection to rulesets.
Two files land alongside that change.

CODEOWNERS is routing only. `require_code_owner_review` stays off in the
ruleset: an approval from any one code owner satisfies it, so the rule
needs two or more owners who actually review before it is anything but a
merge block on a repo with a single author.

The auto-merge workflow arms GitHub auto-merge on non-major Dependabot
PRs. It bypasses no control — the PR still waits on the Build/Lint/Test
gate the ruleset requires — it only removes the manual click once that
gate is green. Majors continue to land by hand.

The `permissions:` block is required rather than defensive: workflows
triggered by Dependabot receive a read-only GITHUB_TOKEN regardless of
the repository default, and the merge step fails without it.

> *This was generated by AI*
---
 .github/CODEOWNERS                          |  5 ++++
 .github/workflows/dependabot_auto_merge.yml | 33 +++++++++++++++++++++
 2 files changed, 38 insertions(+)
 create mode 100644 .github/CODEOWNERS
 create mode 100644 .github/workflows/dependabot_auto_merge.yml

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..208a283
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,5 @@
+# Review routing only. The `default-branch` ruleset does not require code-owner
+# review: GitHub's softener is that an approval from any one code owner suffices,
+# which needs two or more owners who actually review to be anything other than a
+# merge block. Revisit if a second regular reviewer appears.
+* @SyniRon
diff --git a/.github/workflows/dependabot_auto_merge.yml b/.github/workflows/dependabot_auto_merge.yml
new file mode 100644
index 0000000..c545858
--- /dev/null
+++ b/.github/workflows/dependabot_auto_merge.yml
@@ -0,0 +1,33 @@
+name: Dependabot auto-merge
+
+on:
+  pull_request:
+    branches: [develop]
+
+# Dependabot-triggered workflows get a read-only GITHUB_TOKEN regardless of the
+# repository default, so this block is load-bearing — without it the merge step
+# fails on permissions rather than on anything to do with the update itself.
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  automerge:
+    name: Auto-merge
+    if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v3.1.0
+
+      # Arming auto-merge does not bypass anything: the PR still waits on the
+      # Build/Lint/Test gate the ruleset requires. Majors are left to land by
+      # hand. `dependabot.yml` does no grouping, so a PR carries exactly one
+      # update and this gate can't be straddled by a mixed batch.
+      - name: Enable auto-merge for non-major updates
+        if: steps.metadata.outputs.update-type != 'version-update:semver-major'
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}