Check dependencies daily and auto-merge patch updates

.github/dependabot.yml

@@ -1,11 +1,11 @@
-# Dependabot configuration to update npm packages weekly
+# Dependabot configuration to update npm packages daily
 version: 2
 updates:
   - package-ecosystem: "npm"
     directory: "/" # Location of your package.json and package-lock.json
     schedule:
-      interval: "cron"
-      cronjob: "0 17 * * 1,2" # At 5pm on Monday and Tuesday - https://crontab.guru/
+      interval: "daily"
+      time: "17:00"
       timezone: "America/New_York"
     open-pull-requests-limit: 10 # Optional: prevents PR spam by limiting active updates
     ignore:

.github/workflows/dependabot-automerge.yaml

@@ -0,0 +1,29 @@
+name: Dependabot patch auto-merge
+
+on:
+  pull_request_target:
+    branches: ['main']
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    if: >-
+      github.repository == 'reddit/devvit-template-react' &&
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      !github.event.pull_request.draft
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3
+      - name: Enable auto-merge for eligible patches
+        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
+        run: gh pr merge --auto --squash --match-head-commit "$PR_HEAD_SHA" "$PR_URL"
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}