feat: add auto dependency updater

[Morgy93]

This pull request improves automation for dependency and linter management by updating Dependabot configuration and introducing a scheduled workflow for upgrading Trunk linters. These changes help keep dependencies and code quality tools up-to-date with minimal manual intervention.

Dependency management improvements:

• Enhanced .github/dependabot.yml to add labels for dependency PRs and group updates by development dependencies, PHPUnit-related packages, and GitHub Actions, allowing for more organized and manageable update pull requests.

Automated linter upgrades:

• Added .github/workflows/trunk-upgrade.yml to automatically upgrade Trunk CLI and linters weekly, creating a pull request with the changes for review. This workflow uses GitHub Actions and includes steps for checking out code, installing and upgrading Trunk, and opening a PR with dependency labels.

[Copilot]

Pull request overview

This PR improves repository automation around dependency updates and code-quality tooling by enhancing Dependabot grouping/labeling and adding a scheduled GitHub Action to regularly upgrade Trunk CLI/linters and open a PR with the changes.

Changes:

• Add a scheduled trunk upgrade workflow that opens a PR for weekly Trunk CLI/linter upgrades.
• Enhance Dependabot config to label dependency PRs and group certain update types (Composer + GitHub Actions).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/trunk-upgrade.yml	Adds a scheduled/manual workflow to run trunk upgrade and open a PR with dependency labels.
.github/dependabot.yml	Adds dependency PR labels and introduces grouping rules for Composer dev/PHPUnit updates and GitHub Actions updates.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

.github/dependabot.yml:34

• Dependabot GitHub Actions updates are configured to add the dependencies label, but this repo’s label is named Dependencies (capital D). Update the label name so updates get labelled consistently.

    labels:
      - dependencies

.github/dependabot.yml:8

• Dependabot is configured to add the dependencies label, but this repo’s label is named Dependencies (capital D). With the current config, the label won’t be applied (and some tooling can error on unknown labels).

This issue also appears on line 33 of the same file.

    labels:
      - dependencies

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (4)

.github/workflows/trunk-upgrade.yml:42

• The repository’s label naming uses "Dependencies" (capitalised) in .github/labeler.yml, but this workflow applies the lowercase dependencies label. If the exact label doesn’t exist, create-pull-request can fail to apply it and the PR will be missing the intended triage label.

          branch: chore/trunk-upgrade
          delete-branch: true
          labels: dependencies

.github/dependabot.yml:34

• Same label-casing issue as the Composer updates entry above: use the repo’s canonical "Dependencies" label name so GitHub Actions update PRs are labelled consistently.

    labels:
      - dependencies

.github/workflows/trunk-upgrade.yml:12

• Most workflows in this repo define concurrency to prevent overlapping runs (and related branch/PR update races). This scheduled + manual workflow can be triggered concurrently and then fight over the same chore/trunk-upgrade branch.

permissions:
  contents: write
  pull-requests: write

.github/dependabot.yml:8

• The repo’s label set uses the capitalised "Dependencies" label (see .github/labeler.yml), but Dependabot is configured to apply a lowercase dependencies label here. Use the canonical label name to ensure Dependabot PRs are consistently labelled.

This issue also appears on line 33 of the same file.

    labels:
      - dependencies

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (2)

.github/workflows/trunk-upgrade.yml:8

• Add a concurrency block to prevent overlapping scheduled/manual runs of this workflow (the repo’s other workflows use concurrency cancellation to avoid duplicated work and PR update races).

  workflow_dispatch:

.github/workflows/trunk-upgrade.yml:11

• peter-evans/create-pull-request applies PR labels via the Issues API; with the current permissions block the workflow can fail to add the Dependencies label. Grant issues: write (or remove the labels input).

permissions:
  contents: write
  pull-requests: write