add dependabot support for npm and go dependencies

.github/actions/auto-merge.yml

@@ -0,0 +1,15 @@
+name: auto-merge
+
+on:
+  pull_request:
+    paths-ignore:
+      - "src/**" # prevent auto-merge for go dependencies
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: ahmadnassri/action-dependabot-auto-merge@v2 # https://github.com/marketplace/actions/dependabot-auto-merge
+        with:
+          github-token: ${{ secrets.DEPENDABOT_TOKEN }}

.github/auto-merge.yml

@@ -0,0 +1,4 @@
+# auto-merge config file (see https://github.com/marketplace/actions/dependabot-auto-merge#configuration-file-syntax)
+- match:
+    dependency_type: all
+    update_type: "semver:minor" # includes patch updates!

.github/dependabot.yml

@@ -0,0 +1,39 @@
+# See: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    reviewers:
+      - "alcion/platform"
+    open-pull-requests-limit: 50
+
+  # Maintain dependencies for npm - website
+  - package-ecosystem: "npm"
+    directory: "website/"
+    schedule:
+      interval: "daily"
+    reviewers:
+      - "corso-maintainers"
+    open-pull-requests-limit: 50
+
+  # Maintain dependencies for npm - docs
+  - package-ecosystem: "npm"
+    directory: "docs/"
+    schedule:
+      interval: "daily"
+    reviewers:
+      - "corso-maintainers"
+    open-pull-requests-limit: 50
+
+  # Maintain dependencies for go - src
+  - package-ecosystem: "gomod"
+    directory: "src/"
+    schedule:
+      interval: "daily"
+    reviewers:
+      - "corso-maintainers"
+    open-pull-requests-limit: 50