fix: auto-merge workflow permissions and PR detection (#50)

Author: dacrab

.github/workflows/auto-merge-dependabot.yml

@@ -1,10 +1,12 @@
 name: Auto-merge dependabot PRs
 
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
-  check_suite:
-    types: [completed]
+
+permissions:
+  contents: write
+  pull-requests: write
 
 jobs:
   auto-merge:
@@ -13,8 +15,7 @@ jobs:
 
     steps:
       - name: Enable auto-merge for dependabot PRs
-        run: |
-          gh pr merge --auto --squash --delete-branch "$PR_URL"
+        run: gh pr merge --auto --squash --delete-branch "${{ github.event.pull_request.number }}"
         env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}