This action will assign a milestone to a Pull Request

name: 'Auto Milestone Assign'

on:
  pull_request:
    types: [opened]

jobs:
  assign-milestone:
    runs-on: ubuntu-latest

    steps:
      - uses: zoispag/action-assign-milestone@v1
        with:
          repo-token: "${{ secrets.GITHUB_TOKEN }}"
          milestone: 'roadmap'

For pull requests created by dependabot, this action will fail with message: (node:1488) UnhandledPromiseRejectionWarning: HttpError: Resource not accessible by integration.

If you understand the consequences (provide write access) of this action, you can "bypass" this restriction, by triggering this action on the pull_request_target event. Eg:

on:
  pull_request_target:
    types: [opened]

Make sure to read "Keeping your GitHub Actions and workflows secure: Preventing pwn requests" on the GitHub Security Lab website.