[Pigbibi]

AI assistance

Grok Bot (AI agent) wrote this change and its tests for Li SiYi. A human reviewer must approve it before merge.

What changed

• dependabot_auto_merge.yml now triggers on the CI, Documentation check and Engineering governance workflows (previously only CI), checks out the default-branch gate script, and runs it. Permissions stay least-privilege (contents: write, pull-requests: write, plus read-only checks and statuses). The checkout action is pinned by SHA. A per-branch concurrency group avoids duplicate evaluations.
• New scripts/dependabot_auto_merge_gate.py (standard library only) enables gh pr merge --auto --rebase --delete-branch --match-head-commit <sha> only when every check run (latest per name and app, including non-required ones such as Commit message convention) and every commit status (risk-gate, pr-template) on the PR head is green. Failed, cancelled, timed-out and pending checks block it. It waits up to 8 minutes for pending checks, and a later workflow_run re-evaluates.
• It folds in the GdeiAssistant dependabot-policy exclusions, so a human is needed unless:
  • the PR is a same-repository Dependabot PR with the dependencies label, and every commit is authored by dependabot[bot], committed by web-flow and verified (a human push to the branch disables auto-merge);
  • it changes only uv.lock, pyproject.toml or requirements*.txt, or only SHA-pinned uses: version bumps of the same actions in ci.yml / docs-check.yml (never deploy, runtime, release, risk-gate, governance, codeql, hygiene or dependabot workflows);
  • the update is patch or minor, and for dependencies the version is stable and at least 1.0 with no cross-major or prerelease jump.
• New tests/test_dependabot_auto_merge_gate.py with offline fixtures (18 tests).

How verified

• PYTHONPATH=. python3 -m pytest tests/test_dependabot_auto_merge_gate.py: 18 passed.
• Existing workflow-scanning tests in this repo still pass, and scripts/check_style.py reports 0 blocking findings.
• Read-only dry runs of the script against real heads: LongBridge build(deps): bump pyasn1 from 0.6.4 to 0.6.5 #675 (merged earlier while Commit message convention was red) now evaluates as red, and LongBridge chore(deps): bump QuantStrategyLab/QuantRuntimeSettings/actions/publish-runtime-execution-evidence from 2cb9834dc34b8a23e1b261457e1e077bfc414386 to 5fc2a320cf0903fb0475f8bf1d891d47d2d8bd93 #689 (bumps an action in a protected runtime workflow) is skipped as needing a human. Neither dry run enabled auto-merge.
• Not verified end to end: the workflow only runs from the default branch after merge, so the first real Dependabot PR is the live test.

Why

Dependabot PRs were merged while non-required checks (commitlint) were red, because the old workflow waited only for CI and branch protection requires just the five required contexts. It also auto-merged Dependabot bumps of deploy and runtime workflows, Dockerfile base images and 0.x packages, which the GdeiAssistant policy excludes.

Risk

• High-risk path: .github/workflows/** needs the owner-approved label from the owner. This PR adds no labels and stays a draft.
• Behaviour change: Dependabot PRs touching Dockerfile, protected or runtime workflows, tests, 0.x packages, build(deps)-style titles (via commitlint) or groups now need a human. Widen DEPENDENCY_FILE or ACTION_FILES in the script to relax this.
• A cancelled or failed latest check blocks auto-merge until it is re-run. Checks that start later than the 8-minute wait are caught by the next workflow_run.
• --auto still relies on branch protection for required checks. If Dependabot pushes a new head after auto-merge is enabled, GitHub keeps waiting on required checks only, so the next workflow_run re-evaluates the new head.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 57dbaafe-60f3-4fac-b745-b28e44b3a89d

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn