chore(deps): Dependabot hygiene for majors and auto-merge

.github/dependabot.yml

@@ -24,6 +24,7 @@ updates:
         patterns:
           - "*"
     ignore:
+      # Test harness majors deferred (see docs/dependabot-policy.md)
       - dependency-name: bunit
         update-types:
           - version-update:semver-major
@@ -33,6 +34,13 @@ updates:
       - dependency-name: Microsoft.NET.Test.Sdk
         update-types:
           - version-update:semver-major
+      # Syncfusion DocIO/XlsIO PDF render natives — majors need coordinated smoke on NAS/Docker
+      - dependency-name: SkiaSharp.NativeAssets.Linux
+        update-types:
+          - version-update:semver-major
+      - dependency-name: HarfBuzzSharp.NativeAssets.Linux
+        update-types:
+          - version-update:semver-major
 
   - package-ecosystem: github-actions
     directory: /
@@ -57,3 +65,24 @@ updates:
         applies-to: security-updates
         patterns:
           - "*"
+
+  # Root package-lock is repomix/MCP tooling only (not clerk runtime)
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"  # yamllint disable-line rule:quoted-strings
+      timezone: America/Denver
+    open-pull-requests-limit: 3
+    labels:
+      - dependencies
+      - javascript
+    groups:
+      npm-patch-minor:
+        applies-to: version-updates
+        update-types:
+          - patch
+          - minor
+        patterns:
+          - "*"

.github/workflows/dependabot-auto-merge.yml

@@ -1,5 +1,9 @@
-# Approves and auto-merges Dependabot patch/minor PRs after required checks pass.
+# Enables auto-merge for Dependabot patch/minor PRs after required checks pass.
 # Job skips instantly for non-Dependabot PRs (no follow-on workflows).
+#
+# Note: GITHUB_TOKEN cannot approve PRs unless the repo setting
+# "Allow GitHub Actions to create and approve pull requests" is enabled.
+# Approving is optional here (main requires 0 reviews); we only enable auto-merge.
 name: Dependabot auto-merge
 
 on:
@@ -11,7 +15,7 @@ on:
 
 permissions:
   pull-requests: write
-  contents: read
+  contents: write
 
 concurrency:
   group: dependabot-auto-merge-${{ github.event.pull_request.number }}
@@ -28,20 +32,11 @@ jobs:
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 
-      - name: Approve patch/minor version updates
-        if: |
-          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
-          steps.metadata.outputs.update-type == 'version-update:semver-minor'
-        run: gh pr review --approve "$PR_URL"
-        env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Enable auto-merge for patch/minor
         if: |
           steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
           steps.metadata.outputs.update-type == 'version-update:semver-minor'
-        run: gh pr merge --auto --merge "$PR_URL"
+        run: gh pr merge --auto --squash "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

docs/dependabot-policy.md

@@ -6,7 +6,7 @@ How TIKR handles dependency update pull requests. Config: [`.github/dependabot.y
 
 - **Security updates** take priority over routine version bumps.
 - **Reduce PR noise** via grouped patch/minor updates and `open-pull-requests-limit`.
-- **Never merge** a Dependabot PR with failing required checks (`build-and-test`, `trunk_check`).
+- **Never merge** a Dependabot PR with failing required checks (`build-and-test`, `trunk-check`).
 - **Major upgrades** require manual review; some test-stack majors are deferred (see ignore rules in config).
 
 ## Merge tiers
@@ -17,11 +17,12 @@ How TIKR handles dependency update pull requests. Config: [`.github/dependabot.y
 | Patch / minor | NuGet, GitHub Actions | **Auto-merge** when required checks pass |
 | Major | NuGet (general) | Manual review + `dotnet test`; owner merges |
 | Major | `bunit`, `coverlet.collector`, `Microsoft.NET.Test.Sdk` | **Deferred** until Phase 7 test harness work — ignored in config |
+| Major | `SkiaSharp.NativeAssets.Linux`, `HarfBuzzSharp.NativeAssets.Linux` | **Deferred** — Syncfusion DocIO/XlsIO PDF natives; coordinate with renderer smoke — ignored in config |
 
 ## Required CI (non-negotiable)
 
 - **TIKR CI** — `build-and-test` (restore, build, test, Docker smoke optional)
-- **Trunk** — `trunk_check` (gitleaks, yaml/md/docker lint, dotnet format verify)
+- **Trunk** — `trunk-check` (gitleaks, yaml/md/docker lint, dotnet format verify)
 
 ## Weekly rhythm
 
@@ -39,7 +40,7 @@ If `main` moved or CI was broken when a PR opened:
 
 ### Never do
 
-- Merge with red `build-and-test` or `trunk_check`.
+- Merge with red `build-and-test` or `trunk-check`.
 - Auto-merge **major** version updates.
 - Auto-merge **security** PRs without review (manual merge preferred).