fix(ci): drop brittle PAT-based dependabot automerge

.github/workflows/build.yml

@@ -1,6 +1,7 @@
 name: Build
 
 on:
+  workflow_dispatch:
   push:
     branches: [ master ]
   pull_request:

.github/workflows/codeql.yml

@@ -1,6 +1,7 @@
 name: "CodeQL"
 
 on:
+  workflow_dispatch:
   push:
     branches: [ "master" ]
   pull_request:

.github/workflows/dependabot-automerge.yml

@@ -1,7 +1,13 @@
 name: Dependabot Auto-merge
 
-# NOTE: This workflow relies on a Personal Access Token from the @ActivityWatchBot user
-#       See this issue for details: https://github.com/ridedott/merge-me-action/issues/1581
+# Run in the trusted `workflow_run` context and merge Dependabot PRs directly
+# with the repository token instead of depending on an external PAT.
+#
+# The previous implementation used `ridedott/merge-me-action` with the
+# `AWBOT_GH_TOKEN` secret. That PAT expired, so every run failed with
+# "Bad credentials" (2026-10-19). The repository token needs no rotation and is
+# scoped to this run. Same change as ActivityWatch/aw-webui#901 and
+# ActivityWatch/aw-server-rust#643.
 
 on:
   workflow_run:
@@ -13,15 +19,66 @@ on:
 
 permissions:
   contents: write
-  pull-requests: read
+  pull-requests: write
+  actions: write
 
 jobs:
   auto_merge:
     name: Auto-merge
     runs-on: ubuntu-latest
-    if: github.event.workflow_run.conclusion == 'success' && github.actor == 'dependabot[bot]'
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'pull_request' &&
+      github.actor == 'dependabot[bot]'
 
     steps:
-      - uses: ridedott/merge-me-action@v2
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9
         with:
-          GITHUB_TOKEN: ${{ secrets.AWBOT_GH_TOKEN }}
+          script: |
+            const pr = context.payload.workflow_run.pull_requests?.[0];
+            if (!pr) {
+              core.setFailed("No pull request found in workflow_run payload.");
+              return;
+            }
+
+            const { data: pull } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: pr.number,
+            });
+
+            if (pull.state !== "open") {
+              core.info(`PR #${pull.number} is already ${pull.state}; nothing to do.`);
+              return;
+            }
+
+            if (pull.draft) {
+              core.info(`PR #${pull.number} is a draft; skipping.`);
+              return;
+            }
+
+            const { data: merge } = await github.rest.pulls.merge({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: pull.number,
+              merge_method: "squash",
+              sha: context.payload.workflow_run.head_sha,
+            });
+
+            if (!merge.merged) {
+              core.setFailed(`PR #${pull.number} was not merged: ${merge.message}`);
+              return;
+            }
+
+            core.info(`Merged Dependabot PR #${pull.number} at ${merge.sha}.`);
+
+            // GITHUB_TOKEN merges do not trigger push workflows. Dispatch the
+            // default-branch checks explicitly to refresh coverage and CodeQL.
+            for (const workflow_id of ["build.yml", "lint.yml", "codeql.yml"]) {
+              await github.rest.actions.createWorkflowDispatch({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id,
+                ref: pull.base.ref,
+              });
+            }

.github/workflows/lint.yml

@@ -1,6 +1,7 @@
 name: Lint
 
 on:
+  workflow_dispatch:
   push:
     branches: [ master ]
   pull_request: