ci: add workflow to auto-bump deps on upstream release

[congminh1254]

Summary

• Adds a new GitHub Actions workflow (bump-deps.yml) that listens for repository_dispatch events from box-node-sdk and boxcli
• When an upstream release is published, this workflow automatically updates the dependency version in package.json and opens a PR
• The PR commit type matches the semver bump: feat! for major, feat for minor, fix for patch

How it works

1. Upstream repo publishes a release → dispatches event to box/npm-box
2. This workflow compares the new version against the current dep version
3. Updates package.json with the new version
4. Creates a PR with the appropriate conventional commit prefix

Test plan

• Verify workflow syntax is valid
• Test with a manual repository_dispatch event using gh api
• Confirm PR is created with correct title and version bump

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github/​amannn/​action-semantic-pull-request@​505e44b4f33b4c801f063838b3f053990ee46ea7

View full report