ci: merge Dependabot PRs with a GitHub App token instead of GITHUB_TOKEN

GitHub does not let GITHUB_TOKEN-authenticated pushes trigger further
workflow runs, so every prior auto-merge landed on main without
triggering ci.yml or a semantic-release publish.

A GitHub App installation token, minted via actions/create-github-app-token
using the org-installed app whose private key is stored as the
AUTOMERGE_APP_PRIVATE_KEY organization secret, does not carry that
restriction, so the resulting push now cascades normally.

Author: Mearman

.github/workflows/dependabot-auto-merge.yml

@@ -1,6 +1,6 @@
 name: Dependabot auto-merge
 
-# Two auto-merge policies in one workflow. Sibling ExaDev packages (documents.js/odf.js) merge unconditionally once green -- no cooldown, matching this family's existing convention. Every other (third-party) dependency merges only for a minor or patch bump; a major bump still opens a PR via Dependabot but is left for manual review. Third-party updates additionally carry dependabot.yml's own 7-day cooldown before Dependabot proposes them at all. Auto-merge is enforced by main's own CI actually passing on the PR's head commit -- this workflow only requests the merge, GitHub itself withholds it until checks conclude.
+# Two auto-merge policies in one workflow. Sibling ExaDev packages (documents.js/odf.js) merge unconditionally once green -- no cooldown, matching this family's existing convention. Every other (third-party) dependency merges only for a minor or patch bump; a major bump still opens a PR via Dependabot but is left for manual review. Third-party updates additionally carry dependabot.yml's own 7-day cooldown before Dependabot proposes them at all. Auto-merge is enforced by main's own CI actually passing on the PR's head commit -- this workflow only requests the merge, GitHub itself withholds it until checks conclude -- and the merge authenticates via a GitHub App installation token specifically so the resulting push cascades into ci.yml/release, unlike a GITHUB_TOKEN-authenticated push.
 
 on:
   pull_request:
@@ -43,9 +43,15 @@ jobs:
           else
             echo "merge=false" >> "$GITHUB_OUTPUT"
           fi
+      - name: Generate a token for the merge
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: "4473709"
+          private-key: ${{ secrets.AUTOMERGE_APP_PRIVATE_KEY }}
       - name: Enable auto-merge
         if: steps.decide.outputs.merge == 'true'
         run: gh pr merge --auto --rebase "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}