ci(github): trigger automerge on workflow_run instead of pull_request

The workflow previously triggered on every pull_request and skipped
immediately for non-Dependabot PRs, wasting a runner allocation.

Switch to workflow_run on CI completion. The job-level condition gates
on both CI success and the Dependabot actor, so non-Dependabot PRs
never provision a runner at all. As a side effect, auto-merge is now
only attempted after CI passes rather than racing against it.

Author: morbeo

.github/workflows/automerge.yml

@@ -1,8 +1,9 @@
 name: Auto-merge Dependabot
 
 on:
-  pull_request:
-    branches: [master]
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
 
 permissions:
   contents: write
@@ -14,17 +15,21 @@ env:
 jobs:
   automerge:
     runs-on: ubuntu-latest
-    if: github.actor == 'dependabot[bot]'
+    if: |
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.actor.login == 'dependabot[bot]'
     steps:
       - name: Fetch Dependabot metadata
         id: metadata
         uses: dependabot/fetch-metadata@v2
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Enable auto-merge for patch and minor updates
         if: |
           steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
           steps.metadata.outputs.update-type == 'version-update:semver-minor'
         run: gh pr merge --auto --squash "$PR_URL"
         env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
+          PR_URL: ${{ github.event.workflow_run.pull_requests[0].url }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}