AAE-35226 Add new actions to handle Dependabot PRs

[atchertchian]

Checklist

• Jira Reference (also in PR title):
• README updated after adding/changing behaviour of an action
• Proposed version increment for release:
  • Patch (bugfix)
  • Minor (new feature)
  • Major (breaking changes)
• External PR link where changes has been tested: see AAE-35226 Use milestone for Dependabot PR validation flow Activiti/Activiti#5051 but I will need to merge and start using the action with dependabot PRs to check for real

Description

This introduces new actions to:

• gracefully fail the workflow early when it's not going to run ok (replacing the logic at https://github.com/Activiti/Activiti/blob/8.8.0-alpha.62/.github/actions/check-ext-build/action.yml)
• facilitate validating and merging Dependabot PR in a single click, requiring only one human approval

An old related action that is not following good practices anyway was also removed.

[atchertchian]

commenting to see if it triggers pull_request_review event to check https://github.com/Alfresco/alfresco-build-tools/actions/workflows/pr-review-check.yml

[Copilot]

Pull Request Overview

This PR adds two new GitHub Actions to improve Dependabot PR validation and auto-merge workflows, removes an outdated Dependabot action, and bumps the tool’s version to v9.0.0.

• Introduce github-require-secrets (fails early if secrets aren’t available) and github-trigger-approved-pr (labels/milestones and auto-merges on approval).
• Remove deprecated automate-dependabot action.
• Update Dependabot schedules in .github/dependabot.yml and bump version.txt to v9.0.0.

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
docs/README.md	Removed automate-dependabot docs, added new sections and TOC entries for the new actions.
version.txt	Bumped version from v8.24.1 to v9.0.0.
.github/dependabot.yml	Dropped old Dependabot action schedule and added schedules for the new actions.
.github/actions/github-require-secrets/action.yml	New composite action to enforce valid secret sources before running workflows.
.github/actions/github-trigger-approved-pr/action.yml	New composite action to trigger validation, label/milestone PRs, and optionally auto-merge.
.github/actions/automate-dependabot/action.yml	Deleted legacy Dependabot automation action.

Comments suppressed due to low confidence (4)

.github/dependabot.yml:252

• Indentation for the new - package-ecosystem entries is inconsistent with existing blocks (4 spaces vs. 2). Align all entries to the same indent level to keep the YAML valid.

  - package-ecosystem: "github-actions"

.github/actions/github-require-secrets/action.yml:12

• GitHub sets github.secret_source to lowercase values ('dependabot', 'actions', 'codespaces'). Update string comparisons to lowercase to avoid always failing.

        if [[ $SECRET_SOURCE == 'Dependabot' ]]

.github/actions/github-trigger-approved-pr/action.yml:75

• Expressions inside single-quoted strings in github-script won’t be interpolated. Use JS templating (e.g., ``body: `Setting auto-merge on PR after action from @${process.env.ACTOR}```) or build the string in YAML before passing.

            body: 'Setting auto-merge on Dependabot PR after action from @${{ env.ACTOR }}',

.github/actions/github-trigger-approved-pr/action.yml:78

• [nitpick] Step name references "propagation" but this action is generic to any approved PR. Consider renaming to something like "Enable auto-merge for approved PR" for clarity.

    - name: Enable auto-merge for propagation Pull Request

[dsibilio]

LGTM 🚀

Note: there's a rogue reference to the "propagation" that should be slashed off

[Copilot]

Pull Request Overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[gionn]

Overall it looks good and I understand the different use cases. It may be worth adding an item in the cookbook section to describe the approach of using these actions together, since looking at them individually may not fully reveal their purpose.