Set up auto-merge, scheduled tasks and dependabot groups

.github/dependabot.yml

@@ -1,15 +1,37 @@
 version: 2
 updates:
-  - package-ecosystem: "maven"
+  - package-ecosystem: maven
     directories:
       - "/"
-    schedule:
-      interval: "daily"
     cooldown:
       default-days: 7
+      exclude:
+        - "no.entur.*"
+        - "org.entur.*"
+        - "io.entur.*"
+    groups:
+      entur-dependencies:
+        patterns:
+          - "no.entur*"
+          - "org.entur*"
+        update-types:
+          - "patch"
+          - "minor"
+    schedule:
+      interval: "daily"
+
   - package-ecosystem: "github-actions"
     directory: ".github/workflows"
     cooldown:
       default-days: 7
+    ignore:
+      - dependency-name: "entur/*"
+        update-types: ["version-update:semver-minor", "version-update:semver-patch"]
+      - dependency-name: "actions/*"
+        update-types: ["version-update:semver-minor", "version-update:semver-patch"]
+    groups:
+      github-actions:
+        patterns:
+          - "*"
     schedule:
       interval: "daily"

.github/workflows/auto-merge-dependabot.yml

@@ -0,0 +1,28 @@
+name: Auto Merge Dependabot (Entur)
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+
+jobs:
+  auto-merge:
+    if: >
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      github.repository == 'entur/interface-protoc-plugin'
+    uses: entur/abt-gha-public/.github/workflows/auto-merge.yml@v1
+    with:
+      # Semver gate: patch and minor are auto-merged, major needs manual review.
+      auto-merge-patch: true
+      auto-merge-minor: true
+      auto-merge-major: false
+      # Ecosystem gate: only library/package dependencies (maven) are auto-merged.
+      # GitHub Actions and Docker updates are reviewed manually.
+      auto-merge-dependencies: true
+      auto-merge-docker: false
+      auto-merge-github-actions: false
+      channel-id: ${{ vars.ALERT_CHANNEL_ID }}
+    secrets: inherit
+    permissions:
+      pull-requests: write
+      contents: write

.github/workflows/scheduled-tasks.yml

@@ -0,0 +1,21 @@
+name: Scheduled Workflow Tasks
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '30 08 * * 1-5'
+
+jobs:
+  # Dependabot auto-merges via `gh pr merge --auto` are performed by
+  # GITHUB_TOKEN, so the resulting push on main does not trigger
+  # the deploy workflow. This dispatches the deploy if the latest
+  # commit on main is from dependabot and the deploy has not yet run for it.
+  trigger-missed-dependabot-deploy:
+    uses: entur/abt-gha-public/.github/workflows/trigger-missed-dependabot-deploy.yml@v1
+    with:
+      target-workflow: deploy-main.yml
+      target-ref: main
+      channel-id: ${{ vars.ALERT_CHANNEL_ID }}
+    secrets: inherit
+    permissions:
+      contents: read
+      actions: write