Reusable Dependabot merge workflow that disarms auto-merge when a PR carries non-Dependabot commits by unbraind · Pull Request #221 · unbraind/pm-github

Add reusable Dependabot merge workflow with commit provenance guards

unbraind

committed

dd46efa

Distinguish active auto-merge from closed PR metadata

unbraind

committed

aaffdb6

Cover fresh Dependabot requests and track guarded activation

unbraind

committed

d6c10bf

Keep the workflow launcher compatible with publication attestation

unbraind

committed

e12d12e

Avoid revoking requests on token-generated arm events

unbraind

committed

e8762ab

Respect the current command environment under native Bun

unbraind

committed

b1e8285

Scope the thin caller to Dependabot-authored pull requests

unbraind

committed

773283e

Fail closed on incomplete early PR state receipts

unbraind

committed

850e964

Record Dependabot workflow validation and review handoff

unbraind

committed

2652cc9

Merge remote-tracking branch 'origin/main' into feat/reusable-dependabot-merge

unbraind

committed

4939fc0

Bound Dependabot policy calls and preserve pinned self-call policy

unbraind

committed

c21d40e

Record review proofs and baseline release gate receipts

unbraind

committed

440b830

Trust Dependabot workflow source and audit suppressed updates

unbraind

committed

48abcd8

Record second review proofs and release gate receipts

unbraind

committed

4a77bc0

fix: keep Dependabot audit callers within daily runner budget

unbraind

committed

37049e0

docs(pm): record audit policy proofs and pending release gates

unbraind

committed

b4b9cbe

test: make Dependabot timeout receipts independent of startup load

unbraind

committed

028db82

fix: keep bounded shell calls verifiable by attestation

unbraind

committed

fadf64d

fix: identify failed audit revocations and correct baseline evidence

unbraind

committed

324c390

docs: record round-five verification and pending release gates

unbraind

committed

83abb9e

Navigation Menu

Repository navigation

Reusable Dependabot merge workflow that disarms auto-merge when a PR carries non-Dependabot commits - #221

Reusable Dependabot merge workflow that disarms auto-merge when a PR carries non-Dependabot commits#221
unbraind merged 20 commits into
mainfrom
feat/reusable-dependabot-merge

Commits on Nov 5, 2026

Add reusable Dependabot merge workflow with commit provenance guards

Distinguish active auto-merge from closed PR metadata

Cover fresh Dependabot requests and track guarded activation

Keep the workflow launcher compatible with publication attestation

Avoid revoking requests on token-generated arm events

Respect the current command environment under native Bun

Scope the thin caller to Dependabot-authored pull requests

Fail closed on incomplete early PR state receipts

Record Dependabot workflow validation and review handoff

Merge remote-tracking branch 'origin/main' into feat/reusable-dependabot-merge

Bound Dependabot policy calls and preserve pinned self-call policy

Record review proofs and baseline release gate receipts

Trust Dependabot workflow source and audit suppressed updates

Record second review proofs and release gate receipts

fix: keep Dependabot audit callers within daily runner budget

docs(pm): record audit policy proofs and pending release gates

test: make Dependabot timeout receipts independent of startup load

fix: keep bounded shell calls verifiable by attestation

fix: identify failed audit revocations and correct baseline evidence

docs: record round-five verification and pending release gates