vuln-gate + dependabot-auto-merge is circular: repo-wide critical alerts block the very PRs that would fix them

[mmalkhatib]

Problem

The shared `vuln-gate` reusable check (used by `critical-vuln-check.yml` across member repos, e.g. `simplify9/SW-Serverless`) fails a PR if the repository has any open CRITICAL-severity Dependabot alert — not just alerts touched by that PR's diff. Observed today on `simplify9/SW-Serverless`: 13 open critical alerts (all npm, in an unrelated `SW.Serverless.InstallerUI` subproject) fail `vuln-gate` on every open PR, including PRs that touch completely unrelated files (verified on a plain C# library-code PR).

This is circular: Dependabot's own remediation PR for these alerts (simplify9/SW-Serverless#95) is itself blocked by the same `vuln-gate` check, and its `dependabot-auto-merge.yml` `auto-merge` job shows `skipping` as a result — so the one mechanism meant to clear the alerts can never run. Confirmed the same failure on #95, #101, and an unrelated PR (#104), all currently blocked on `main` in SW-Serverless with no path to merge via normal automation.

Compounding this: `main`'s branch ruleset in that repo has `bypass_actors: []` (empty), so even an org-admin `--admin` merge attempt is rejected — `gh pr merge --admin` fails with `GraphQL: Required status check "vuln-gate / check" is failing.` There is currently no way to merge anything to `main` in that repo without first clearing all 13 critical alerts by hand.

Suggested fixes (any one would break the cycle)

1. Scope `vuln-gate` to only fail on alerts affecting packages actually touched by the PR's diff, not every alert in the repo.
2. Exempt Dependabot-authored PRs from `vuln-gate` (or run it after, not before, `dependabot-auto-merge`), so remediation PRs aren't blocked by the alerts they exist to fix.
3. Add a documented bypass actor (e.g. a specific team/role) to affected repos' branch rulesets for exactly this recovery scenario.

Repro

• Repo: `simplify9/SW-Serverless`
• Any open PR — e.g. Kill child process on CommandTimeout to prevent stale-result mix-ups SW-Serverless#104 (unrelated C# change) or Bump the npm_and_yarn group across 1 directory with 19 updates SW-Serverless#95 (Dependabot's own npm bump, which only covers 1 of the 13 critical advisories) both fail `vuln-gate / check`.
• `gh api repos/simplify9/SW-Serverless/actions/jobs//logs` shows the check enumerating all 13 repo-wide critical alerts regardless of PR diff.

🤖 Generated with Claude Code