Use dependabot

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"

.github/workflows/CI.yml

@@ -74,6 +74,26 @@ jobs:
       #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       #     ATOM_ACCESS_TOKEN: ${{ secrets.ATOM_ACCESS_TOKEN  }}
 
+  # Automerge:
+  #   needs: [Test, Lint]
+  #   runs-on: ubuntu-latest
+  #   if: |
+  #     github.actor == 'dependabot[bot]' &&
+  #     github.event_name == 'pull_request' &&
+  #     startsWith(github.event.pull_request.title, 'chore(deps-dev):')
+  #   steps:
+  #     - name: '@dependabot merge'
+  #       uses: actions/github-script@v2
+  #       with:
+  #         github-token: ${{secrets.GH_TOKEN}}
+  #         script: |
+  #           await github.issues.createComment({
+  #             owner: context.payload.repository.owner.login,
+  #             repo: context.payload.repository.name,
+  #             issue_number: context.payload.pull_request.number,
+  #             body: '@dependabot merge'
+  #           })
+
   Skip:
     if: contains(github.event.head_commit.message, '[skip ci]')
     runs-on: ubuntu-latest