ci(automerge): use AUTOMERGE_PAT with GITHUB_TOKEN fallback (#49)

The default GITHUB_TOKEN cannot enable auto-merge on PRs that modify
.github/workflows/** (github-actions ecosystem bumps), so those Dependabot
PRs stall and need a manual/admin merge.

Allow an optional AUTOMERGE_PAT secret (repo + workflow scope) to be used
for `gh pr merge --auto`, falling back to GITHUB_TOKEN when the secret is
not set — so behavior is unchanged until the secret is added.

Author: amavashev

.github/workflows/dependabot-auto-merge.yml

@@ -23,4 +23,8 @@ jobs:
         run: gh pr merge --auto --merge "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # AUTOMERGE_PAT (repo+workflow scope) lets auto-merge work on PRs that
+          # touch .github/workflows/** (e.g. github-actions bumps); the default
+          # GITHUB_TOKEN is forbidden by GitHub from doing so. Falls back to
+          # GITHUB_TOKEN when the secret is absent (unchanged behavior).
+          GH_TOKEN: ${{ secrets.AUTOMERGE_PAT || secrets.GITHUB_TOKEN }}