fix: remove invalid root npm Dependabot job

[seonghobae]

Description

The default-branch Dependabot update job fails with dependency_file_not_found: /package.json not found because .github/dependabot.yml declares an npm workspace at /, while this repository keeps its npm manifest under /frontend.

This PR removes the invalid root npm update entry, keeps the existing /frontend npm group active, and adds a release-governance regression test requiring every configured npm directory to contain package.json.

It also enforces a seven-day Dependabot cooldown for all eight configured ecosystems so newly published versions receive an observation window before automated update PRs are opened.

Current default-branch failure evidence: https://github.com/ContextualWisdomLab/naruon/actions/runs/29713481048 (develop HEAD 58d19ee90b34c9cf18c163c03f1f8f05bbce2dce)

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

Validation

• uv run --project backend --locked python -m pytest backend/tests/test_release_governance.py -q — 35 passed
• python -m ruff check backend/tests/test_release_governance.py
• git diff --check
• parsed .github/dependabot.yml with PyYAML and confirmed eight update entries, valid npm manifests, and seven-day cooldowns
• codegraph sync and targeted post-change exploration
• current-head hosted application, image, CodeQL, dependency-review, OSV, Trivy, Bandit, Semgrep, gitleaks, Scorecard, Strix, and Noema checks pass

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• My changes generate no new warnings
• I have added tests that prove my fix is effective
• New and existing focused unit tests pass locally with my changes
• No dependent downstream publication is required

[github-actions]

PR governance metadata gate is not ready for d88da989c2a65cfac43a7ce4d08f0ae750fc0691:

• Review decision is CHANGES_REQUESTED; address requested changes before merge.

[cwl-noema-review]

Noema PydanticAI review

The PR removes an invalid root-level npm update job from the Dependabot config. It also adds or enforces the 'cooldown' field for update jobs and adds test coverage in 'backend/tests/test_release_governance.py' to ensure npm directories tracked by Dependabot actually have a package manifest and that all update jobs enforce a minimum cooldown. All workflow checks, static analysis (SARIF), dependency, and governance checks are passing. No MEDIUM-or-higher dependency findings are open. Tests confirm configuration correctness. The evidence supports approval: the PR improves configuration maintainability and correctness, with no indication of regression or risk.

Findings

• No blocking findings.

• Result: APPROVE

• Verdict: approve

• Confidence: high

• Head SHA: ddf94fba9cd22d1d3d70d004f64718884abc9cf1

• Reviewer credential: noema-github-app

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head ddf94fba9cd22d1d3d70d004f64718884abc9cf1.

• Head SHA: ddf94fba9cd22d1d3d70d004f64718884abc9cf1

• Workflow run: 29881496708

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: dependabot.yml"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: dependabot.yml"]
  R1 --> V1["required checks"]
  Evidence --> S2["Backend: test_release_governance.py"]
  S2 --> I2["API and service runtime"]
  I2 --> R2["Review risk: Backend: test_release_governance.py"]
  R2 --> V2["backend tests"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: ddf94fba9cd22d1d3d70d004f64718884abc9cf1
• Workflow run: 29881496708
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head ddf94fba9cd22d1d3d70d004f64718884abc9cf1.

• Head SHA: ddf94fba9cd22d1d3d70d004f64718884abc9cf1

• Workflow run: 29881496708

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: dependabot.yml"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: dependabot.yml"]
  R1 --> V1["required checks"]
  Evidence --> S2["Backend: test_release_governance.py"]
  S2 --> I2["API and service runtime"]
  I2 --> R2["Review risk: Backend: test_release_governance.py"]
  R2 --> V2["backend tests"]

Loading

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 7 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0924773c-84be-4a21-8b8e-a91df888bb1e

📥 Commits

Reviewing files that changed from the base of the PR and between ab6442b and d88da98.

📒 Files selected for processing (2)

• .github/dependabot.yml
• backend/tests/test_release_governance.py

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Closing after Loop drain: permanently blocked — branch was updated onto develop for mergeability, which cleared prior APPROVED robot evidence; re-review (CodeRabbit/OpenCode) and/or central gate jobs (metadata-only gate evaluation, coverage-evidence) remained pending/stuck without a re-runnable workflow handle. Not force-merging (merge-gate policy). Re-open a focused PR when robot capacity is available. Related product security fixes that reimplemented cleanly remain on branch goal/carddav-path-traversal-decode (#1206) for relaunch.