Reusable workflow pinned to branch ref, not immutable tag

[twistedmelonman]

Non-Blocking Review Concern: Reusable workflow pinned to branch ref, not immutable tag

Source: pre-push whole-codebase review
Location: .github/workflows/dependabot-auto-merge.yml:13
Date: 2026-08-11

What was flagged

The reusable workflow is referenced at @dependabot-auto-merge-v2, which is a branch name. Branch refs are mutable — a force-push to that branch changes the behavior of this workflow without any change to this repo. The claude-blocking-review.yml uses immutable tags (@v3.1.0) and release.yml uses commit SHAs — both are safer patterns. If dependabot-auto-merge-v2 is a long-lived stable branch rather than a semantic version, consider tagging a release and pinning to that tag instead.

Context

This issue was automatically created from a non-blocking concern identified
during pre-push whole-codebase review. It was flagged for tracking.

---

Created by lib-review-issues.sh

[twistedmelonman]

Part of the smartwatermelon/dev-env#20 fleet migration; closing as verified non-issue.