[Copilot]

Adds tooling for Copilot to assess Dependabot updates against full upstream release notes and Dropapp usages, then propose minimal compatibility fixes.

• Review skill and agent

  • Covers Composer, npm/Yarn, Actions and Docker updates, including grouped PRs.
  • Requires code-location evidence, explicit uncertainty, proposed diffs and a structured merge recommendation.
  • Includes repo-specific Smarty, Auth0, Phinx and Cypress guidance.

• Automatic requests

  • API-only pull_request_target workflow for Dependabot opened/reopened events.
  • Minimal write permissions, same-repository guards and duplicate-comment suppression; no checkout or PR-code execution.
  • Optional COPILOT_TRIGGER_TOKEN Dependabot secret, falling back to GITHUB_TOKEN; bot comments may not trigger Copilot.

• Manual usage

  • README documents the custom agent, workflow and token setup:

    @copilot use the review-dependabot-update skill on this PR
    

Application code and CircleCI configuration remain unchanged; deployments are prohibited.

[pylipp]

Validation of the Dependabot review tooling:

• Passed: workflow YAML/skill frontmatter checks and mocked GitHub API tests for posting, null/unrelated comments, pagination configuration and duplicate suppression (5 cases). No live trigger comment was posted.
• Passed: PHP parallel lint (389 files), php build.php, changed-file secret scan, and CodeQL Actions analysis (0 alerts).
• Existing formatter limitation: the required auto-fix command exited 64 with errors reported while fixing generated Smarty templates; dry-run exited 72 and also reported existing style violations. Unrelated formatter/build changes were discarded, leaving only the four requested files.
• Local PHP smoke checks: homepage redirects to development Auth0 (HTTP 301); nonexistent page returns HTTP 404. Logs show an existing startup JIT/extension warning, no request-time errors. Cypress feature tests are not run because these changes do not affect application behavior.
• Inspected recent GitHub Actions runs: action-required state, with no failed jobs/logs in the inspected run. Automatic Copilot invocation still requires live verification after merge and may require the documented Dependabot PAT secret.
• The automated code-review tool was unavailable due to a model configuration error. A separate read-only code-review agent reviewed the workflow, skill and documentation as a fallback and found no significant issues.