ci: Dependabot auto-merge — base-controlled dependabot-gate + trace carve-out (Tier 3, operator-merge) - #113
Conversation
…e carve-out with commit-author guard Operator decision 2026-08-17. Mirrors the workspace change: validate-trace reports success (not skip) for dependabot[bot] PRs and hard-fails on any non-Dependabot-authored commit; auto-merge arms only after a summoned Codex review is submitted. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…odex r1 REQUEST_CHANGES integrated) Mirrors the workspace redesign: validate-trace hard-fails for dependabot PRs unless commits are authentic (author + web-flow + verified signature) and a head-bound clean Codex signal exists; automerge workflow reduced to summon / arm / retrigger / best-effort disarm. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…(Codex r2 integrated) pull_request workflows run PR-controlled code; the merge-blocking gate now lives in dependabot-gate.yml (pull_request_target + ref:main, always-run required context) with trust-boundary pin tests. compliance-trace.yml keeps only the trace exemption notice. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…seline pass) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…y skipping them (Codex bounded-confirm catch) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: aab0d1cf9a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…sed; sync with workspace redesign Mirrors workspace 94e8e80d: dependabot-automerge summon/arm move to pull_request_target (writable token, zero checkout); dependabot_gate.py fails closed on an empty commit list (Grok c9). Plugin gate already lived in the dedicated dependabot-gate.yml (Codex r2). Docs corrected: the gate is dependabot-gate.yml, not validate-trace. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b9f85ba24a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
… P1) + changelog fragment (P2) Mirrors workspace: arm verifies dependabot-gate is required before enabling auto-merge. Adds changelog.d fragment for the public-governance contract change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bf002bc167
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ests (GLM c1 parity) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 199b097e54
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ner (Codex connector P2) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…oning (Codex connector self-containment) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c9409d6f70
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
… (Codex connector P2 race) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9177e494d4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…est commit-filter docstring Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 participant
Dependabot auto-merge: base-controlled gate + validate-trace carve-out
Companion to workspace PR sumitake/agent-collab-workspace#2764 (operator decision 2026-08-17; full review
trail there). Plugin side:
dependabot-gate.yml— base-controlled (pull_request_target+ explicitref: maincheckout;no PR code executes) required context enforcing commit authenticity (author + web-flow committer +
verified signature) and the head-bound Codex clean-signal via
scripts/dependabot_gate.py. Always runs(no skip-deadlock); no-ops success for non-Dependabot authors. Operator must add
dependabot-gateto required checks by re-running the workspace's
scripts/enable-branch-protection.sh(list alreadyupdated in #2764).
compliance-trace.yml—dependabot[bot]PRs skip the trace steps via a notice step (requiredcontext reports success, never skipped). Deliberately holds NO gate logic:
pull_requestworkflows runPR-controlled code (Codex r2 finding — a foreign commit could rewrite a gate here).
dependabot-automerge.yml— summon / arm / retrigger only; no merge-blocking authority.scripts/dependabot_gate.py+scripts/test_dependabot_gate.py(real-payload fixtures + trust-boundarypin tests);
docs/public-governance.md+dependabot.ymlupdated.Supersedes the per-PR hand-adjudication path (operator decision 2026-08-04, PR #67) by the newer
2026-08-17 operator instruction. No plugin release: CI/governance only, no distributed content.
author: claude
standing_directives: operator decision 2026-08-17 (Dependabot auto-merge, both repos, everything); directive #6 Tier 3; operational-reliability baseline; cross-repo merge-order (workspace first — protection-script list lands there)
tier: 3
cross_check: PROCEED-WITH-MODIFICATIONS (Grok/xAI, direct CLI, 2 rounds — verbatim verdicts quoted in workspace PR #2764; all concerns integrated)
post_condition: scripts/test_dependabot_gate.py 16 tests green incl. trust-boundary pins; all 3 workflow YAMLs parse; pre-commit release-consistency PASS; required-context addition pending operator protection-script run
mcp_coverage_gap: NONE
contributor_rights: OWNER-AUTHORED
operator_reserved: yes — .github/workflows/* high-risk Tier-3 sub-class under reviewer-failover conditions routes the merge to the operator (presented ready-to-merge)
peer_review_verdict: REQUEST_CHANGES (all findings integrated; merge operator-routed)
peer_review_agent: glm
peer_review_message_id: glm-NA (direct runtime; Codex CLI quota + Gemini timeout -> D2 failover to GLM). Full trail in workspace PR #2764.
peer_review_reviewed_sha: 199b097
peer_review_concerns_integrated: "Grok/xAI skip-pass bypass -> dedicated dependabot-gate.yml; Codex/OpenAI (CLI+connector) PR-controlled-gate + arm-fail-open + changelog fragment; GLM/Zhipu C1 DOA path (this repo's gate path was already correct at scripts/) + path-existence pin added for parity. Merge operator-routed (.github/workflows/* Tier-3)."
plugin_affected: NONE — CI/governance workflows only; no distributed plugin content, no release
readme_refresh_status: README unaffected (no release, no version bump)
🤖 Generated with Claude Code