Automate dependency update merges

[Snuffy2]

Summary

Adds guarded auto-merge workflows for prek hook updates plus npm and GitHub Actions Dependabot pull requests, with weekly checks and a seven-day cooldown for version updates.

What Changed

• Configured weekly npm and GitHub Actions Dependabot checks with cooldown.default-days: 7 for both ecosystems.
• Configured prek updates to use the dedicated update bot identity.
• Added bot, repository, branch, base, and ecosystem-specific changed-file verification before enabling SHA-bound squash auto-merge.
• Added full ShellPort validation for npm updates and YAML/actionlint validation for GitHub Actions updates.
• Added fail-closed cleanup that revokes stale auto-merge requests after unsuccessful re-verification.

Why

This reduces routine dependency maintenance while ensuring only narrowly scoped, bot-authored updates can be merged automatically after ecosystem-appropriate validation succeeds.

Before Merge

• Enable repository auto-merge.
• Configure PREK_AUTOUPDATE_TOKEN for the prek update workflow.

Greptile Summary

This PR adds guarded auto-merge automation for Dependabot and prek-generated updates, alongside weekly dependency update configuration.

• Adds weekly npm and GitHub Actions Dependabot checks with a seven-day cooldown.
• Restricts auto-merge eligibility by bot identity, repository, branch, base branch, ecosystem, and changed files.
• Adds SHA-bound squash auto-merge and fail-closed revocation jobs.
• Configures prek updates to use a dedicated bot identity and token.

Confidence Score: 2/5

The PR is not yet safe to merge because dependency updates can bypass the intended validation and a mutable third-party action still receives a write-capable repository secret.

Dependabot auto-merge now proceeds after filename authorization without YAML/actionlint validation, and the prek update workflow continues to expose PREK_AUTOUPDATE_TOKEN to Snuffy2/prek-autoupdate@v2 rather than a reviewed immutable commit.

Files Needing Attention: .github/workflows/dependabot-auto-merge.yml and .github/workflows/prek_autoupdate.yml

Important Files Changed

Filename	Overview
.github/dependabot.yml	Adds weekly npm and GitHub Actions update schedules with seven-day cooldowns.
.github/workflows/dependabot-auto-merge.yml	Adds tightly scoped Dependabot auto-merge authorization, but auto-merge is enabled without the promised ecosystem validation.
.github/workflows/prek-autoupdate-auto-merge.yml	Adds bot, branch, repository, base, and changed-file checks around prek update auto-merge.
.github/workflows/prek_autoupdate.yml	Configures the dedicated prek update identity and secret, while the previously reported mutable secret-consuming action remains.

Prompt To Fix All With AI

### Issue 1
.github/workflows/dependabot-auto-merge.yml:63-64
**Auto-merge bypasses dependency validation**

When a Dependabot GitHub Actions update modifies an allowed workflow or action file but contains invalid YAML or Actions configuration, `enable-auto-merge` runs after filename authorization without YAML or actionlint validation, causing the invalid update to be automatically merged and repository workflows to fail.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (3): Last reviewed commit: "Avoid duplicate Dependabot validation" | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 56844b8d-0035-4ac2-b8c3-5f02232a4df2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Mutable installer controls merge validation

If the upstream taiki-e/install-action@v2 tag is retargeted, the verification job executes unreviewed installer code and uses its installed prek binary to determine success, allowing an unsafe GitHub Actions dependency update to be approved for auto-merge. How this was verified: The mutable installer supplies the executable used by the checks whose success starts the write-capable auto-merge job.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/dependabot-auto-merge.yml
Line: 97

Comment:
**Mutable installer controls merge validation**

If the upstream `taiki-e/install-action@v2` tag is retargeted, the verification job executes unreviewed installer code and uses its installed `prek` binary to determine success, allowing an unsafe GitHub Actions dependency update to be approved for auto-merge. **How this was verified:** The mutable installer supplies the executable used by the checks whose success starts the write-capable auto-merge job.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.