Backport: security-deps — allowed_bots re-run fix + native bun audit
Source: ForumViriumHelsinki/.github → reusable-security-deps.yml
Why
allowed_bots: "*" fixes the human-actor guard blocking re-runs of bot-authored (Renovate/release-please) dependency PRs — GitHub replays the original bot sender on re-run. Audit-and-comment is read-only with a fixed prompt, so it's safe.- Native
bun audit --json (Bun ≥ 1.2.15) instead of an npm audit fallback that ENOLOCKs without a package-lock.json.
- Cheaper model + lower
max-turns.
⚠️ Sequencing
reusable-security-deps.yml was recently changed locally (model/turns split) — reconcile against the current file before applying; do not diff against a stale copy.
Sanitization log
None required.
Verification
Confidence: medium (logic sound; land after the recent local change settles).
Part of a feature-parity backport sweep between ForumViriumHelsinki/.github and laurigates/.github. Sanitization verified before any PR is opened; logic is org-agnostic.
Backport: security-deps —
allowed_botsre-run fix + nativebun auditSource:
ForumViriumHelsinki/.github→reusable-security-deps.ymlWhy
allowed_bots: "*"fixes the human-actor guard blocking re-runs of bot-authored (Renovate/release-please) dependency PRs — GitHub replays the original bot sender on re-run. Audit-and-comment is read-only with a fixed prompt, so it's safe.bun audit --json(Bun ≥ 1.2.15) instead of annpm auditfallback thatENOLOCKs without apackage-lock.json.max-turns.reusable-security-deps.ymlwas recently changed locally (model/turns split) — reconcile against the current file before applying; do not diff against a stale copy.Sanitization log
None required.
Verification
Confidence: medium (logic sound; land after the recent local change settles).
Part of a feature-parity backport sweep between
ForumViriumHelsinki/.githubandlaurigates/.github. Sanitization verified before any PR is opened; logic is org-agnostic.