- Switch trigger to `pull_request_target` with `opened`, `synchronize`, and `reopened` events for safer automation - Add explicit check that the actor is `dependabot[bot]` to prevent unintended executions - Use `GITHUB_TOKEN` instead of a dedicated secret and enable `use-github-auto-merge` for automatic merging of minor updates