Add Dependabot auto-merge and verify-or-revert workflows

Automate Dependabot dependency bumps end to end, gated on the post-merge
"Publish to website" deploy that pushes generated content to the
innersourcecommons.org repo.

- dependabot-auto-merge.yml: auto-approve and enable auto-merge for patch and
  minor Dependabot bumps; hold major bumps for a human, since majors are what
  have broken the deploy before.
- revert-bump-on-failed-deploy.yml: when the deploy fails on a bump commit,
  open a revert PR that mentions the learning-path maintainers and enable
  auto-merge on it (one approval still completes the revert).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018zv3SKYNduHEhVyNWLb3Xh

Author: rrrutledge

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,38 @@
+name: Dependabot auto-merge
+
+# Auto-approves and enables auto-merge for Dependabot dependency bumps, scoped to
+# patch and minor updates. Major bumps (e.g. asciidoctor 3 -> 4) are held for a
+# human, because those are the ones that have broken the "Publish to website"
+# deploy in the past. The companion "Revert bump on failed deploy" workflow is the
+# safety net for a patch/minor bump that still breaks the deploy after it merges.
+#
+# Requires the repo setting "Allow auto-merge" to be enabled, and "Allow GitHub
+# Actions to create and approve pull requests" (already on for this repo).
+
+on: pull_request_target
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  auto-merge:
+    if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch Dependabot metadata
+        id: meta
+        uses: dependabot/fetch-metadata@v2
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Approve and enable auto-merge (patch/minor only)
+        if: >
+          steps.meta.outputs.update-type == 'version-update:semver-patch' ||
+          steps.meta.outputs.update-type == 'version-update:semver-minor'
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh pr review --approve "$PR_URL"
+          gh pr merge --auto --squash "$PR_URL"

.github/workflows/revert-bump-on-failed-deploy.yml

@@ -0,0 +1,60 @@
+name: Revert bump on failed deploy
+
+# Safety net for the Dependabot auto-merge flow. When "Publish to website" fails on
+# a push to main whose commit is a Dependabot bump ("Bump ..."), this opens a PR
+# that reverts that commit and @-mentions the maintainers. The revert PR is set to
+# auto-merge, but branch protection still requires one approving review, so a
+# maintainer clicks approve to complete the revert. That review is also the backstop
+# against a false revert: a deploy can fail for a reason unrelated to the bump that
+# happened to trigger the run, and the maintainer sees the failing run before
+# approving.
+#
+# To make the revert fully hands-off (no human approval), a GitHub App token acting
+# as a second identity could approve the revert PR; today the default token cannot
+# approve a PR it opened itself.
+
+on:
+  workflow_run:
+    workflows: ["Publish to website"]
+    types: [completed]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  revert:
+    if: >
+      github.event.workflow_run.event == 'push' &&
+      github.event.workflow_run.head_branch == 'main' &&
+      github.event.workflow_run.conclusion == 'failure' &&
+      startsWith(github.event.workflow_run.head_commit.message, 'Bump ')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Revert the breaking bump and open a PR
+        env:
+          SHA: ${{ github.event.workflow_run.head_sha }}
+          TITLE: ${{ github.event.workflow_run.head_commit.message }}
+          RUN_URL: ${{ github.event.workflow_run.html_url }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          BRANCH="revert-deploy-${SHA:0:8}"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -b "$BRANCH"
+          if ! git revert --no-edit "$SHA"; then
+            echo "::error::Revert of $SHA did not apply cleanly; a maintainer must revert by hand."
+            git revert --abort || true
+            exit 1
+          fi
+          git push origin "$BRANCH"
+          BODY=$(printf '@InnerSourceCommons/learning-path the **Publish to website** deploy failed after this dependency bump merged to `main`, so it was reverted automatically.\n\nFailed run: %s\nReverted commit: %s\n\nThis revert PR has auto-merge enabled and needs one approving review to complete. Before approving, confirm the failing run was actually caused by this bump (a deploy can fail for an unrelated reason). Once the deploy is healthy again, Dependabot will re-open the bump on its next run.' "$RUN_URL" "$SHA")
+          gh pr create --base main --head "$BRANCH" \
+            --title "Revert bump that broke the deploy: $TITLE" \
+            --body "$BODY"
+          gh pr merge --auto --squash "$BRANCH" || true