fix: dependabot PR settings — remove self-assignment, add auto squash-merge

[Copilot]

What does this PR do?

Fixes Dependabot PRs incorrectly assigning rania-run as assignee and adds automatic squash-and-merge on approval.

Related issue

Addresses issue requirements for proper Dependabot PR automation.

Changes

.github/dependabot.yml

• assignees → reviewers for both pub and github-actions ecosystems
• Ensures rania-run is requested as reviewer, not assigned

.github/workflows/auto-assign.yml

• Added github.event.pull_request.user.login != 'dependabot[bot]' condition
• Prevents auto-assignment workflow from processing Dependabot PRs

.github/workflows/dependabot-automerge.yml (new)

• Enables GitHub auto-merge API with squash method on Dependabot PRs
• Triggers: PR events, reviews, check suite completions
• Merges automatically once approvals + checks pass

How to test

Wait for next Dependabot PR or manually trigger:

1. Verify assignee = dependabot[bot] only
2. Verify rania-run listed as reviewer
3. Approve PR → observe auto-merge engage after checks pass

Checklist

• dart analyze --fatal-infos passes
• dart format --set-exit-if-changed . passes
• Tests added / updated for every new behaviour
• No debug code or commented-out blocks left in

Original prompt

---

This section details on the original issue you should resolve

<issue_title>chore: fix dependabot PR settings — remove self-assignment, add auto squash-and-merge</issue_title>
<issue_description>## Problem

Dependabot PRs are currently assigning rania-run as an assignee alongside dependabot. This is noisy and incorrect — rania-run should only appear as a reviewer, not an assignee.

Additionally, once a dependabot PR is approved, it should automatically squash-and-merge without manual intervention.

Tasks

• Update .github/dependabot.yml to remove rania-run from assignees
• Add rania-run as a reviewer in the dependabot config instead
• Configure auto squash-and-merge for dependabot PRs — via one of:
  • GitHub repo settings: enable Auto-merge + add a branch ruleset/protection requiring approval
  • A .github/workflows/dependabot-automerge.yml workflow that calls gh pr merge --squash --auto once the PR is approved and checks pass

Expected Result

• Dependabot PRs: assignee = dependabot[bot] only
• Dependabot PRs: reviewer = rania-run
• Dependabot PRs: auto squash-and-merge after approval + passing checks</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes chore: fix dependabot PR settings — remove self-assignment, add auto squash-and-merge #9

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.