Auto-merge only Dependabot's own minor/patch group PRs

.github/dependabot.yml

@@ -18,6 +18,12 @@ updates:
       include: "scope"
     groups:
       all-minor-patch:
+        applies-to: version-updates
+        update-types:
+          - "minor"
+          - "patch"
+      security-minor-patch:
+        applies-to: security-updates
         update-types:
           - "minor"
           - "patch"
@@ -36,4 +42,9 @@ updates:
       - "github-actions"
     commit-message:
       prefix: "ci"
-      include: "scope"
+      include: "scope"
+    groups:
+      actions-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"

.github/workflows/dependabot-auto-merge.yml

@@ -12,8 +12,14 @@ jobs:
     steps:
       - uses: dependabot/fetch-metadata@v3
         id: meta
-      - name: Auto-merge patch and minor updates
-        if: steps.meta.outputs.update-type != 'version-update:semver-major'
+      - name: Auto-merge Dependabot's minor/patch group PRs
+        # Merge only PRs Dependabot itself filed as a minor/patch group. Group
+        # membership is decided from versions Dependabot could actually compare;
+        # anything outside a group is a major, a security update, or a
+        # requirement range it could not classify. fetch-metadata's update-type
+        # is not a safe gate for those: Claude-Patent-Creator #82 widened mcp
+        # from <2.0.0 to <3.0.0 and it reported "version-update:semver-patch".
+        if: endsWith(steps.meta.outputs.dependency-group, 'minor-patch')
         run: gh pr merge "$PR_URL" --auto --squash
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}