ci: auto-merge Dependabot pip range updates (minor/patch)

[iscarelli]

Problem

Dependabot does not classify pip range updates (pyotp>=2.9 → pyotp>=2.10.0). dependabot/fetch-metadata returns an empty update-type, previous-version and new-version — confirmed in the job log of #54:

outputs.update-type: null
outputs.previous-version:
outputs.new-version:

So the auto-merge condition never fired and every requirements.txt PR stayed open forever: 5 piled up between 2026-06-14 and 2026-07-25 (#51 #52 #53 #54 #55), all with green CI.

Fix

A fallback step that derives the bump from the PR title when update-type is empty, and fails closed — anything that is not exactly from >=X to >=Y with the same major is left open for manual review. Major bumps keep today's behaviour.

The title is read from env, never interpolated into the script: this is a pull_request_target workflow with write permissions.

Verification

The classifier was run against every real title, plus edge cases:

Title	Result
update pyotp requirement from >=2.9 to >=2.10.0	merge
update flask requirement from >=3.0 to >=3.1.3	merge
update qrcode[pil] requirement from >=8.2 to >=8.3	merge (extras in the name)
update gunicorn requirement from >=21.0 to >=26.0.0	left open (major)
update flask requirement from >=3.0,<4 to >=3.1,<5	left open (unknown shape)
bump actions/checkout from 6 to 7	left open (handled by update-type)
update foo requirement from >=1.0 to >=1.1 && curl evil.sh	left open

.github/workflows/dependabot-automerge.yml parses as valid YAML with the three expected steps.

No app change — CI only, so no VERSION bump.

🤖 Generated with Claude Code