From aa39db3f5e5f9cc8fe12858d04945411873c1667 Mon Sep 17 00:00:00 2001
From: Marijn Doeve <marijn@doeve.me>
Date: Thu, 21 May 2026 20:35:48 +0200
Subject: [PATCH] Dependabot config (#105)

* Group Symfony and twig

* Enable automerge for dev dependencies
---
 .github/dependabot.yml                      | 17 +++++++++++++-
 .github/workflows/dependabot-auto-merge.yml | 25 +++++++++++++++++++++
 2 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/dependabot-auto-merge.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 4fa1f06..b256bd7 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,9 +7,24 @@ version: 2
 updates:
   - package-ecosystem: "composer" # See documentation for possible values
     directory: "/" # Location of package manifests
+    allow:
+      # Allow both direct and indirect updates for all packages
+      - dependency-type: "all"
     schedule:
       interval: "daily"
+    ignore:
+      - dependency-name: "symfony/*"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+    groups:
+      dev-dependencies:
+        dependency-type: "development"
+      symfony:
+        patterns:
+          - "symfony/*"
+      twig:
+        patterns:
+          - "twig/*"
   - package-ecosystem: "docker"
-    directtory: "/"
+    directory: "/"
     schedule:
       interval: "daily"
diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
new file mode 100644
index 0000000..f9d3180
--- /dev/null
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -0,0 +1,25 @@
+name: Dependabot auto-merge
+on: pull_request
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  dependabot:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    steps:
+      - name: Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v2
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+      - name: Enable auto-merge for Dependabot PRs
+        if: contains(steps.metadata.outputs.dependency-type, 'development')
+        run: |
+          gh pr review --approve "$PR_URL"
+          gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}