fix: harden Dependabot automation (#123)

* fix: harden Dependabot automation

Co-Authored-By: Codex <noreply@openai.com>

* fix: retain disabled workflow tombstone

Co-Authored-By: Codex <noreply@openai.com>

---------

Co-authored-by: Codex <noreply@openai.com>

Author: Pigbibi

.github/CODEOWNERS

@@ -1 +1,3 @@
-* @Pigbibi
+# Strategy decisions and execution entrypoints require owner visibility.
+/src/crypto_strategies/entrypoints/ @Pigbibi
+/src/crypto_strategies/strategies/ @Pigbibi

.github/dependabot.yml

@@ -18,3 +18,4 @@ updates:
   - dependency-name: "*"
     update-types:
     - "version-update:semver-major"
+  - dependency-name: "QuantStrategyLab/QuantPlatformKit/.github/workflows/reusable-drift-check.yml"

.github/workflows/dependabot_auto_merge.yml

@@ -43,7 +43,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
-          gh pr view "${{ steps.pr.outputs.pr_number }}" --repo "${GITHUB_REPOSITORY}" --json number,isDraft,author,url,body,labels > pr.json
+          gh pr view "${{ steps.pr.outputs.pr_number }}" --repo "${GITHUB_REPOSITORY}" --json number,isDraft,author,url,title,body,labels > pr.json
           python3 - <<'PY'
           import json
           import os
@@ -52,15 +52,20 @@ jobs:
           pr = json.loads(Path("pr.json").read_text(encoding="utf-8"))
           author = (pr.get("author") or {}).get("login")
           labels = {item.get("name", "") for item in pr.get("labels", [])}
+          title = pr.get("title") or ""
           body = pr.get("body") or ""
           is_major = "update-type: version-update:semver-major" in body
+          sensitive_labels = {"docker", "github_actions"}
+          is_sensitive = bool(labels & sensitive_labels) or "QuantStrategyLab/" in title or "QuantStrategyLab/" in body
           dependabot_authors = {"dependabot[bot]", "app/dependabot"}
           is_dependabot = author in dependabot_authors and "dependencies" in labels
-          should_merge = is_dependabot and not pr.get("isDraft") and not is_major
+          should_merge = is_dependabot and not pr.get("isDraft") and not is_major and not is_sensitive
           if should_merge:
               reason = "ready"
           elif is_major:
               reason = "major_update"
+          elif is_sensitive:
+              reason = "sensitive_dependency_update"
           else:
               reason = "not_eligible_dependabot_pr"
 
@@ -71,6 +76,7 @@ jobs:
               f"- Draft: `{'yes' if pr.get('isDraft') else 'no'}`",
               f"- Dependabot label: `{'yes' if 'dependencies' in labels else 'no'}`",
               f"- Major update: `{'yes' if is_major else 'no'}`",
+              f"- Sensitive dependency class: `{'yes' if is_sensitive else 'no'}`",
               f"- Final merge decision: `{'merge' if should_merge else 'skip'}`",
               f"- Reason: `{reason}`",
           ]
@@ -88,4 +94,4 @@ jobs:
         if: steps.merge_guard.outputs.should_merge == 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh pr merge "${{ steps.pr.outputs.pr_number }}" --repo "${GITHUB_REPOSITORY}" --rebase --delete-branch --match-head-commit "${{ steps.pr.outputs.head_sha }}"
+        run: gh pr merge "${{ steps.pr.outputs.pr_number }}" --repo "${GITHUB_REPOSITORY}" --auto --rebase --delete-branch --match-head-commit "${{ steps.pr.outputs.head_sha }}"

.github/workflows/dependabot_review_request_cleanup.yml

@@ -1,8 +1,8 @@
 name: Dismiss Dependabot Review Request
 
+# Disabled tombstone: automatic cleanup cannot retract an already-sent review notification.
 "on":
-  pull_request_target:
-    types: [review_requested]
+  workflow_dispatch:
 
 permissions:
   contents: read