restore dependabot auto merging using the workflow_run event

[bendavies]

This pull request restores the auto-merging of dependabot PRs.

The event is switched to use workflow_run, which runs with write permissions as so secrets (ERGEBNIS_BOT_TOKEN) are available in the run.

for more information see: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

I have been unable to retain all conditions of the previous if statement, namely these.

    if: >
...
      github.event.pull_request.draft == false && (
        github.event.action == 'opened' ||
        github.event.action == 'reopened' ||
        github.event.action == 'synchronize'
      ) && (
...
        (github.actor == 'localheinz' && contains(github.event.pull_request.labels.*.name, 'merge'))
      )

An alternative will have to be found if these are critical.

Thanks!

[codecov]

Codecov Report

Merging #759 (718e422) into main (2a2f779) will not change coverage.
The diff coverage is n/a.

❗ Current head 718e422 differs from pull request most recent head 63a186a. Consider uploading reports for the commit 63a186a to get more accurate results

@@             Coverage Diff             @@
##                main      #759   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
  Complexity         3         3           
===========================================
  Files              1         1           
  Lines              6         6           
===========================================
  Hits               6         6           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2a2f779...63a186a. Read the comment docs.

[bendavies]

I'm not sure i understand the yaml link error. can you explain?

[localheinz]

Let's give this a try!

[localheinz]

Thank you, @bendavies and @Lctrs!

[localheinz]

@bendavies and @Lctrs

Works like a charm, see:

• github-actions(deps): bump shivammathur/setup-php from 2.11.0 to 2.12.0 #750
• https://github.com/ergebnis/php-package-template/runs/3280618721

Thank you very much!