chore(config): 优化 Dependabot 合并策略 (启用群组构建)

.github/dependabot.yml

@@ -17,7 +17,15 @@ updates:
       - "frontend"
     commit-message:
       prefix: "chore(deps)"
-    # 忽略主要版本升级（手动处理）
+    # 将前端的只读小版本(minor)与修订版(patch)打包到一个 PR，避免满屏 PR 的困扰
+    groups:
+      client-minor-patch-updates:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+    # 忽略主要版本升级（重大升级由主人来指定时间手动处理）
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
@@ -36,16 +44,31 @@ updates:
       - "backend"
     commit-message:
       prefix: "chore(deps)"
+    # 后端同样开启打包合并更新策略
+    groups:
+      server-minor-patch-updates:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
     ignore:
       - dependency-name: "*"
         update-types: ["version-update:semver-major"]
 
-  # GitHub Actions（如果未来添加 CI/CD）
+  # GitHub Actions
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "Asia/Shanghai"
     labels:
       - "dependencies"
     commit-message:
       prefix: "chore(ci)"
+    groups:
+      actions-updates:
+        patterns:
+          - "*"

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,35 @@
+name: Dependabot Auto-Merge
+
+# 在 Dependabot 发起 PR 时触发
+on: pull_request
+
+# 给予 GitHub Actions 机器人对 PR 和代码内容的写入与审批权限
+permissions:
+  pull-requests: write
+  contents: write
+
+jobs:
+  dependabot:
+    runs-on: ubuntu-latest
+    # 这一行是安全阀，确保这个无脑合并的工作流只对官方的 Dependabot 机器人生效
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - name: Fetch Dependabot metadata
+        id: dependabot-metadata
+        uses: dependabot/fetch-metadata@v2
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+
+      - name: Auto-Approve the PR
+        run: gh pr review --approve "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
+
+      - name: Enable Auto-Merge (Squash)
+        # 只要 CI（比如 ESLint 等构建步骤）由于通过了校验变成绿灯
+        # 就会立刻执行 Squash 合并
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}