test(supply-chain): require supported dependency update automation

[seonghobae]

Scope

Draft dependency-update configuration child of #402. The existing Python matrix/security dependency foundation is inherited through a non-force merge; the child-owned delta is only .github/dependabot.yml and its executable contract. Protected main remains the only shipped authority. Refetch the live parent, child, base, ancestry, checks and reviews before every lifecycle action.

This lane does not change editor/runtime/package semantics, credentials, transport, persistence, tenancy, model/provider, deployment or release authority.

Supported automation boundary

The repository declares pnpm@11.5.3, while GitHub Dependabot's supported pnpm range does not currently cover pnpm 11. This lane therefore does not add a knowingly unsupported root npm/pnpm Dependabot entry or registry credentials.

The active configuration enables only currently supported, credential-free weekly update surfaces:

• GitHub Actions in /;
• Python/pip in /office.

src/dependencyUpdateAutomation.test.ts binds that finite surface and rejects accidental root npm automation or credential-bearing registry configuration.

TDD lineage

• Test-only head 5371e978f58a38769e6195e837d64d5e43b32061 established the intended contract but exposed a test-runtime compatibility error before reaching the product boundary; it is not accepted RED evidence.
• 366f0793867370a8c7dab31f8152a4d9a1a5348e repaired the test harness and produced the realistic RED: .github/dependabot.yml was absent while the supported automation contract executed.
• d67b316566bb6f5231cfa3ccc79cddaa3bbe1331 added the narrow two-ecosystem Dependabot configuration. Hosted CI then exposed an indentation assumption in the test regex rather than a configuration defect.
• Earlier repair 642d4a40551d725adb0a5f49e9073506a9085c25 fixed only that test parser assumption while preserving the intended automation boundary.

Evidence and dependency-graph prerequisite

GitHub dependency review requires the repository Dependency graph feature. A repository-setting RCA and same-base/head API recheck are recorded in the #402 repair evidence. The reproduced HTTP 403 condition was a disabled Inkspan repository setting; this lane does not patch or bypass the central workflow. A successful API recheck does not replace a successful terminal CI job.

Per-generation local test/build/package results belong in dated PR comments. Neither the historical TDD lineage nor parent/predecessor CI and review results transfer to a new child head. Pending, queued, skipped-required, cancelled, absent, neutral, failed, stale, wrong-checkout, synthetic-source, status-only or model-only evidence is non-passing.

Integration boundary

Keep this PR Draft behind #402 until the parent is protected and every applicable exact-child-head gate passes. Before any lifecycle transition, refetch protected main, parent/child heads, live base, ancestry/mergeability, the two-file ownership delta, active writers, repository and central workflow jobs with actual checkout identities, qualifying independent approvals, unresolved threads and live rulesets. Release issue #118 remains the downstream stable-release acceptance boundary.

Do not self-approve, force-push, weaken gates, fabricate pnpm 11 update coverage, add registry credentials, create a competing workflow repair or infer protected/release authority from this branch.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Repaired the blocked dependency order with non-force merge 0e96660, containing current #402 parent 637b910. The PR is now based on codex/fix-python-boundary-coverage; its parent-relative delta remains only .github/dependabot.yml and src/dependencyUpdateAutomation.test.ts. On this unchanged child head: frozen-lockfile install, typecheck, 157 test files / 884 tests, 100% statement/branch/function/line coverage, full library build and packed-package verification all pass locally. The existing weekly GitHub Actions and Office pip update scope is unchanged; no unsupported pnpm 11 or credentials were added. The historical dependency-review 403 prerequisite was repaired in Inkspan settings, as recorded in #402; hosted reruns and qualifying independent review remain separate gates. This child remains Draft, and no stable-release or protected-main claim is made.

[seonghobae]

A post-restack assertion audit found a false-green case: changing only the GitHub Actions schedule from weekly to monthly or daily still passed the original regex because it borrowed the following Office entry’s weekly schedule. New negative controls reproduced both failures (2 failed / 2 passed) before the repair. Commit aa287ad splits the configured update entries before applying the existing ecosystem/directory/schedule assertions, so each entry must independently satisfy its weekly contract. All 4 focused checks then pass. On this committed head, the full suite passes 157 files / 886 tests with 100% statement/branch/function/line coverage, and packed-package verification passes. The two-file parent-relative scope is unchanged; no dependency-update configuration, production source, credential or security gate was changed by this follow-up.