From 3599590cafed38195c37743e34db6cb039cc168a Mon Sep 17 00:00:00 2001
From: Cursor <cursor@proxymesh.com>
Date: Tue, 1 Sep 2026 21:21:14 +0000
Subject: [PATCH 1/2] Group Dependabot updates and add auto-merge workflow

Weekly grouped updates for pip (prod minor/patch, all dev) and
github-actions, plus auto-squash merge for non-major Dependabot PRs.

Co-authored-by: ProxyMesh AI <proxymeshai@users.noreply.github.com>
---
 .github/dependabot.yml                      | 31 ++++++++++++++++-----
 .github/workflows/dependabot-auto-merge.yml | 18 ++++++++++++
 2 files changed, 42 insertions(+), 7 deletions(-)
 create mode 100644 .github/workflows/dependabot-auto-merge.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7af809c..43ad3b7 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,17 +1,34 @@
-#
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-#
-
 version: 2
 updates:
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
       interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 3
+    labels:
+      - "dependencies"
+      - "automerge"
+    groups:
+      prod-minor-patch:
+        dependency-type: "production"
+        update-types:
+          - "minor"
+          - "patch"
+      dev-all:
+        dependency-type: "development"
+        update-types:
+          - "minor"
+          - "patch"
+          - "major"
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+      day: "monday"
+    groups:
+      actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
new file mode 100644
index 0000000..979058a
--- /dev/null
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -0,0 +1,18 @@
+name: dependabot-auto-merge
+on:
+  pull_request_target
+permissions:
+  contents: write
+  pull-requests: write
+jobs:
+  automerge:
+    if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: dependabot/fetch-metadata@v2
+        id: meta
+      - if: steps.meta.outputs.update-type != 'version-update:semver-major'
+        run: gh pr merge --auto --squash "$PR"
+        env:
+          PR: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From 971c42b2118230cb3d72f2ac3acffb34d5148282 Mon Sep 17 00:00:00 2001
From: Cursor <cursor@proxymesh.com>
Date: Tue, 1 Sep 2026 21:23:46 +0000
Subject: [PATCH 2/2] Pin dependabot/fetch-metadata to commit SHA

Match existing workflow style: action@sha with version comment.

Co-authored-by: ProxyMesh AI <proxymeshai@users.noreply.github.com>
---
 .github/workflows/dependabot-auto-merge.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 979058a..eaafb2b 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -9,7 +9,7 @@ jobs:
     if: github.actor == 'dependabot[bot]'
     runs-on: ubuntu-latest
     steps:
-      - uses: dependabot/fetch-metadata@v2
+      - uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
         id: meta
       - if: steps.meta.outputs.update-type != 'version-update:semver-major'
         run: gh pr merge --auto --squash "$PR"