ci: decide Dependabot auto-merge with fetch-metadata's update-type

[plum117]

Summary

The Dependabot auto-merge job (update.yml) read the old and new versions from the PR title ("from x.y.z to a.b.c"). A group PR title has no versions ("bump the npm_and_yarn group across 1 directory with 9 updates"), so the job failed with "Version numbers not found in PR title" and showed a red check (#1295).

dependabot/fetch-metadata already gives the highest semver change of the PR as update-type, also for groups. The workflow now uses it.

Changes

• Removed the 3 steps that read the title, extracted the versions and compared the majors.
• The wait and auto-merge steps run only for npm updates with update-type version-update:semver-minor or version-update:semver-patch.
• Behavior:

Update	Before	After
Single npm minor/patch	auto-merge	auto-merge
Single npm major	waits for a person	waits for a person
Group of direct updates	job failed	auto-merge if the highest change is minor/patch, else waits
Group of indirect updates (update-type: null, like #1295)	job failed	waits for a person (job passes)
GitHub Actions updates	waits for a person	waits for a person

• Also removes ${{ github.event.pull_request.title }} from a run: script, which was a script-injection risk.

Test

• The YAML parses; the step conditions are as above.
• The chore(deps): bump the npm_and_yarn group across 1 directory with 9 updates #1295 run log shows outputs.update-type: null and outputs.package-ecosystem: npm_and_yarn for a group of indirect updates, so with the new condition that PR would wait for a person instead of failing.
• The real proof is the next Dependabot PR.

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: dfebd0d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no actionable issues were found.

Summary

Replaces PR-title parsing with fetch-metadata outputs to decide which Dependabot updates can merge automatically.

• Dependabot updates use their reported change type to decide auto-merge.

_{Reviews (1) · Last reviewed commit: "ci: decide Dependabot auto-merge with fe..." · Reviewed by Greptile}