feat(kodiak): auto-approve+merge Dependabot patch/minor bumps

.github/CODEOWNERS

@@ -0,0 +1,10 @@
+# Merge-governance surface. Any change under /.github/ — including a NEW
+# workflow file, which can run on its own PR with GITHUB_TOKEN write
+# permissions — requires a human code-owner review to merge. Pairs with
+# branch protection "Require review from Code Owners".
+/.github/ @derivita/engineering
+
+# Kodiak's merge-queue config — an unreviewed edit here could weaken or
+# disable branch-protection-equivalent merge gating (e.g. the automerge
+# label, blocking labels, or merge method).
+/.kodiak.toml @derivita/engineering

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      minor-and-patch:
+        update-types:
+          - minor
+          - patch

.github/workflows/dependabot-automerge-label.yml

@@ -0,0 +1,32 @@
+name: Dependabot Auto-merge Label
+
+# Labels Dependabot's own patch/minor npm bumps `automerge` +
+# `dependabot-automerge` so Kodiak can auto-approve and merge them. See
+# derivita/shared-workflows's dependabot-automerge-label.yml (the reusable
+# workflow this calls) for the full security rationale, and
+# derivita/infrastructure#1716 for the reference rollout.
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize]
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  label:
+    # Skip the runner allocation entirely for human PRs — the callee no-ops
+    # on these anyway (it does its own author and head-commit-signature
+    # checks), but there's no reason to spend a job on every PR to main to
+    # find that out.
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    # Pinned to the v1 tag's commit, not the mutable tag itself — this
+    # workflow controls what gets auto-approved, and anyone with write
+    # access to shared-workflows can retarget a tag with no PR in this repo.
+    uses: derivita/shared-workflows/.github/workflows/dependabot-automerge-label.yml@9752b04e2e27d6cbc6a06908345e85db2b576abf # v1
+    with:
+      # fetch-metadata's package-ecosystem slug for npm/pnpm, not
+      # dependabot.yml's "npm" value — see the callee's own comment on
+      # this naming split.
+      ecosystems: npm_and_yarn

.kodiak.toml

@@ -0,0 +1,26 @@
+version = 1
+
+[merge]
+automerge_label = "automerge"
+method = "squash"
+delete_branch_on_merge = true
+blocking_labels = ["wip", "do-not-merge"]
+
+[approve]
+# Dedicated label, not the general-purpose `automerge` merge-queue label:
+# auto_approve_labels grants Kodiak's own bot approval to anything carrying
+# this label regardless of author. Reusing `automerge` would let any
+# contributor with label-write access get an unreviewed PR auto-approved
+# just by attaching it.
+#
+# dependabot-automerge is only *intended* to be applied by
+# dependabot-automerge-label.yml, after its own semver/ecosystem check
+# confirms the PR is a provable patch/minor dependency bump — never by
+# hand. GitHub doesn't restrict which repo collaborators can attach an
+# *existing* label, and Kodiak's evaluation here only checks label
+# presence, not who added it or the PR's author, so anyone with
+# Triage/Write access could still self-apply it to their own PR for an
+# unreviewed auto-approval. Accepted risk, matching derivita/infrastructure
+# #1716: this repo's collaborators are trusted, and required status checks
+# still gate every PR regardless of label.
+auto_approve_labels = ["dependabot-automerge"]