[zoeyrose]

Summary

The owner approved auto-merging Dependabot patch and minor updates once required CI passes (2026-10-22). This adds the shared policy for Atrinik:

• a reusable workflow, .github/workflows/dependabot-auto-merge.yml, that component repositories call from a thin pull_request caller;
• allow_auto_merge: true in config/repository-defaults.json, checked by bin/audit;
• dependabot/fetch-metadata@* in the selected-actions allowlist.

Majors, updates of unknown type, and anything failing CI stay manual.

Implementation / behavior

• classify job (read-only token): runs only on pull requests authored by dependabot[bot]. It requires that Dependabot triggered the run and authored every commit. It runs dependabot/fetch-metadata (pinned to v3.1.0 by SHA), which verifies the signed first commit. The pull request is eligible only when every entry in updated-dependencies-json is semver-patch or semver-minor. The action's own update-type output ignores entries of unknown type, so the job does not use it. That way a grouped PR with a bare SHA or digest change is not let through on the strength of its minor siblings. Updates to dependabot/fetch-metadata or to atrinik/github-settings always need a person, because such a PR would classify itself with the new code.
• apply job (contents: write, pull-requests: write): runs only gh, with no checkout. If the PR is eligible it runs gh pr merge --auto --squash --match-head-commit <classified head>. Otherwise it disables any earlier auto-merge request. That covers a grouped PR that Dependabot later widens to include a major, and a person's push, including Update branch.
• No approvals are required by any ruleset (required_approving_review_count: 0 in 02 - Changes through pull requests), so no bot approval is needed. can_approve_pull_request_reviews stays false. Required CI, thread resolution and the strict up-to-date policy are unchanged, and no protection is loosened.
• README gains a Dependabot auto-merge section with the caller template and known limits. AGENTS.md records the invariants.

Validation

• bin/validate: valid.
• tests/*.sh: all pass locally.
• actionlint 1.7.12 on the new workflow: clean.
• The jq eligibility filter was exercised against all-minor/patch, a mixed group containing an unknown type, a major, an empty list, a dependabot/fetch-metadata update, an atrinik/github-settings update and malformed input. Only the first is eligible.
• bin/publish plan: as expected, it shows the selected-actions PUT and the repository-defaults PATCH for every active repository. The plan also contains already pending, unrelated mutations from earlier merged changes: the playtester merge queue (feat(rulesets): pilot a merge queue on playtester #102), the pathfinder required-CI ruleset (feat(repositories): require pathfinder CI #98), and deletion of the editor/renderer rulesets (chore: drop editor and renderer after transfer to Seraphina Studios #99). A broad --apply would apply those too.

Limitations / follow-up

• Merges are made with GITHUB_TOKEN, so the push to main does not trigger push or workflow_run workflows (main-branch Check, releases, development deploys). Those pick the change up with the next merge by a person. Changing this needs a dedicated GitHub App credential; that is an owner decision and out of scope here.
• With strict required checks, a request waits while the branch is behind. Dependabot rebases its own PRs. Pressing Update branch makes the PR manual.
• 0.x minor bumps count as minor, as GitHub reports them.
• Applying needs owner authorization: either dispatch Publish settings, which applies everything pending, or apply only these two settings. Callers in component repositories follow in separate PRs once this merges, pinned to the merge commit. The pilot is metaserver-worker.

🤖 Generated with Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues found.

Scanned Files

• .github/workflows/dependabot-auto-merge.yml

[zoeyrose]

Self-review of #103.

Full review. A fresh-context subagent reviewed f99a5fa against main (9e5aa0c) using the intent brief. It covered the workflow, config, bin/audit, the publisher/validate/test call sites, and the fetch-metadata v3.1.0 source. It ran actionlint, bin/validate and tests/*.sh. Findings and how each was handled:

• P2: classify failure skipped the disable path. A stale request could survive a Dependabot widening a group to include a major. Fixed in 76b6efe: apply runs on !cancelled() && result != skipped; enabling needs eligible plus a successful classification; a failure to read the commits fails closed.
• P2: merge-queue repo (playtester) unverified. A GITHUB_TOKEN enqueue may not start merge_group checks. Fixed in 76b6efe: playtester is documented as excluded from rollout until this is verified live.
• P2: README overstated Dependabot rebasing behind branches. Fixed in 76b6efe and ad9da89: the README now documents @dependabot rebase and hedges the claim.
• P3: self-update exclusion was case-sensitive. Fixed in 76b6efe (ascii_downcase).
• P3: merge-ref wording was wrong. Fixed in 76b6efe.
• P3: rollout ordering was not stated. Fixed in 76b6efe.
• P3: no audit test for allow_auto_merge drift. Fixed in 76b6efe: a new auto-merge-drift fixture; the reviewer confirmed it fails without the audit check.
• P3: caller template matched any base branch. Fixed in 76b6efe (branches: [main]).

Delta review. The same reviewer reviewed 76b6efe. It found the cancellation ordering safe (an older run cannot override a newer decision) and the always-run apply fail-closed. It left two P3s:

• P3: README said a disabled PR is "merged by hand" even after a transient failure. Fixed in ad9da89: re-running the workflow restores the request.
• P3: a failure of apply's own gh call leaves a stale request, signalled only by a red run. Accepted and declined: there is no further fallback without a second credential, and the failed run is visible.

ad9da89. This commit is docs-only README wording: the recovery note, the hedged rebase claim, and an explicit accepted-risk note for minor GitHub Actions updates plus the unverified GITHUB_TOKEN merge of workflow-file changes, which the pilot verifies. I reviewed it myself; bin/validate passes.

[zoeyrose]

Closing: the owner decided against Dependabot auto-merge (Oct 22, 2026). Grouping, cooldown and single-source pins stay.