Auto-merge approved dependency updates

Queue trusted dependency-bot PRs for the default branch after approval.
Require the existing functional CI checks before merging, and keep
changes-requested reviews blocking automatic merges.

Author: knu

.github/mergify.yml

@@ -0,0 +1,31 @@
+queue_rules:
+- name: dependency-updates
+  batch_size: 1
+  checks_timeout: auto
+  merge_method: merge
+  queue_conditions:
+  - base = master
+  - author ~= ^(dependabot|renovate|lockfile-maintenance)\[bot\]$
+  - -draft
+  - -conflict
+  - '#approved-reviews-by >= 1'
+  - '#changes-requested-reviews-by = 0'
+  merge_conditions: &id001
+  - '#approved-reviews-by >= 1'
+  - '#changes-requested-reviews-by = 0'
+  batch_max_wait_time: 1 min
+merge_protections:
+- name: approved-dependency-updates
+  if:
+  - base = master
+  - author ~= ^(dependabot|renovate|lockfile-maintenance)\[bot\]$
+  success_conditions: *id001
+merge_protections_settings:
+  auto_merge_conditions:
+  - base = master
+  - author ~= ^(dependabot|renovate|lockfile-maintenance)\[bot\]$
+  - -draft
+  - -conflict
+  - '#approved-reviews-by >= 1'
+  - '#changes-requested-reviews-by = 0'
+  reporting_method: check-runs