ci: allow dependabot auto-merge on human rebases

Currently, the dependabot-auto-merge workflow (which rebuilds dist/) only runs if the actor is dependabot[bot]. If a human rebases a dependabot PR (e.g. via UI or CLI), this workflow is skipped, causing CI to fail because dist/ is out of sync.

This change:
1. Relaxes the condition to run on any branch starting with 'dependabot/', regardless of actor.
2. Adds workflow_dispatch trigger for manual fixes.
3. Updates CI workflow permissions.

Signed-off-by: Jason Hall <imjasonh@gmail.com>

.github/workflows/ci.yml

@@ -7,6 +7,10 @@ on:
     branches: [main]
   workflow_dispatch:
 
+permissions:
+  actions: write
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest

.github/workflows/dependabot-auto-merge.yml

@@ -1,6 +1,8 @@
 name: Dependabot auto-merge
 
-on: pull_request
+on:
+  pull_request:
+  workflow_dispatch:
 
 permissions:
   contents: write
@@ -10,11 +12,11 @@ permissions:
 jobs:
   dependabot:
     runs-on: ubuntu-latest
-    if: github.actor == 'dependabot[bot]'
+    if: ${{ github.actor == 'dependabot[bot]' || startsWith(github.head_ref || github.ref_name, 'dependabot/') }}
     steps:
       - uses: actions/checkout@v6
         with:
-          ref: ${{ github.event.pull_request.head.ref }}
+          ref: ${{ github.event.pull_request.head.ref || github.ref_name }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v6
@@ -42,12 +44,12 @@ jobs:
 
       - name: Trigger CI
         if: steps.commit.outputs.pushed == 'true'
-        run: gh workflow run ci.yml --ref ${{ github.event.pull_request.head.ref }}
+        run: gh workflow run ci.yml --ref ${{ github.event.pull_request.head.ref || github.ref_name }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Enable auto-merge for Dependabot PRs
         run: gh pr merge --auto --squash "$PR_URL"
         env:
-          PR_URL: ${{github.event.pull_request.html_url}}
+          PR_URL: ${{ github.event.pull_request.html_url || github.ref_name }}
           GH_TOKEN: ${{secrets.GITHUB_TOKEN}}