ci: group Dependabot updates and auto-merge minor and patch bumps

[MathiasVDA]

Requested by Mathias · project thread

Before: Dependabot only opened security PRs, one per package, and nothing merged on its own.

After: once a month Dependabot opens one grouped PR each for cargo, Docker and GitHub Actions updates, with a 7-day cooldown and chore(deps) / ci(deps) titles. Minor and patch updates turn on auto-merge and land once CI passes. Majors stay open for a manual look.

How: .github/dependabot.yml and .github/workflows/dependabot-automerge.yml. No separate cargo audit is needed here, because CI already runs cargo deny check, which covers RUSTSEC advisories.

Auto-merge only waits for CI when main has a ruleset that requires it. Merge this together with that ruleset and the "Allow auto-merge" setting; until then gh pr merge --auto just fails.

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[MathiasVDA]

Two checks fail here, and neither comes from this PR, which only adds .github/dependabot.yml and a workflow. The last run on main was in May, and both checks would fail there today too.

• License & Security Check: cargo deny now reports RUSTSEC-2026-0177 in pyo3 0.21.2. This is the same pyo3 version pin that deny.toml already ignores for RUSTSEC-2025-0020, because polars blocks the upgrade. tp-lib does not call the affected API (PyCFunction::new_closure). The repo has no Cargo.lock, so each run resolves fresh and picks up new advisories.
• Python Tests: a newer, unpinned ruff flags 19 style issues in tp-py/python (for example Optional[X] → X | None). 17 of them can be fixed automatically with ruff check --fix.

No fix exists yet. The proposed patch is to add RUSTSEC-2026-0177 to the deny.toml ignore list with the same polars reason, and to apply ruff check --fix tp-py/python. Both go in a separate PR once the maintainer agrees, rather than widening this one.

---

Generated by Claude Code