ci: add Dependabot auto-merge and group lockstep deps

Auto-merges patch and minor Dependabot PRs once required CI checks pass.
Groups AWS SDK v2, Jackson, and Mockito (all version-pinned together via
${version.*} properties) plus actions/attest-* so SBOM and provenance
action bumps land in a single PR.

Avoids `update-types: ["minor", "patch"]` inside groups (dependabot-core
#14202 silently suppresses major-version PRs for matched deps).

Author: jcputney

.github/dependabot.yml

@@ -5,8 +5,26 @@ updates:
     schedule:
       interval: "daily"
     open-pull-requests-limit: 20
+    groups:
+      aws-sdk:
+        patterns:
+          - "software.amazon.awssdk:*"
+      jackson:
+        patterns:
+          - "com.fasterxml.jackson.core:*"
+          - "com.fasterxml.jackson.dataformat:*"
+          - "com.fasterxml.jackson.datatype:*"
+          - "com.fasterxml.jackson.module:*"
+      mockito:
+        patterns:
+          - "org.mockito:*"
+
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "daily"
     open-pull-requests-limit: 20
+    groups:
+      actions-attest:
+        patterns:
+          - "actions/attest-*"

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,29 @@
+name: Dependabot auto-merge
+
+on:
+  pull_request_target:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  auto-merge:
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Fetch Dependabot metadata
+        id: meta
+        uses: dependabot/fetch-metadata@v2
+
+      - name: Enable auto-merge for patch and minor updates
+        if: |
+          steps.meta.outputs.update-type == 'version-update:semver-patch' ||
+          steps.meta.outputs.update-type == 'version-update:semver-minor'
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}