Update dependency auto-merge workflows

[Snuffy2]

Summary

Modernizes ShellPort's automated dependency maintenance and refreshes the npm lockfile to the latest versions permitted by the existing dependency ranges.

What Changed

• Hardened Dependabot auto-merge with independent metadata and changed-file verification for supported npm and GitHub Actions updates
• Added stale auto-merge revocation when a synchronized Dependabot pull request no longer passes verification
• Switched prek-autoupdate to its integrated auto-merge: true syntax with read-only workflow permissions
• Removed the redundant standalone prek-autoupdate auto-merge workflow
• Updated transitive npm dependencies while preserving the declared dependency ranges

Why

The current automation duplicated prek-autoupdate's built-in behavior and relied on narrower Dependabot branch-name checks. Using the action's integrated auto-merge contract reduces maintenance, while explicit metadata and file verification keeps automated merges fail-closed.

Refreshing and resynchronizing the lockfile ensures clean installs resolve the current compatible dependency graph without known audit findings.

Summary by CodeRabbit

• Chores
  • Improved automatic merging for eligible dependency and GitHub Actions updates after validation.
  • Restricted automatic merges to approved, same-repository changes targeting the default branch.
  • Removed the separate automation for automatically merging pre-commit configuration updates.
  • Updated pre-commit maintenance automation to use read-only access while enabling automatic merging.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: 217cab34-4557-4110-b4c5-cfc77ff19f78

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9619b528-5cd1-4226-b82f-b5de0f556980

📥 Commits

Reviewing files that changed from the base of the PR and between ed72b5e and 2c34db4.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (3)

• .github/workflows/dependabot-auto-merge.yml
• .github/workflows/prek-autoupdate-auto-merge.yml
• .github/workflows/prek_autoupdate.yml

💤 Files with no reviewable changes (1)

• .github/workflows/prek-autoupdate-auto-merge.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The workflows update Dependabot pull request validation, restrict accepted changed files, adjust auto-merge failure handling, remove the prek auto-merge workflow, and enable automatic merging from the prek autoupdate workflow with read-only contents access.

Changes

Workflow automation

Layer / File(s)	Summary
Dependabot validation and merge control .github/workflows/dependabot-auto-merge.yml	The workflow validates same-repository Dependabot pull requests against the default branch. It accepts only package-lock.json or GitHub Actions YAML changes. Auto-merge requires both checks, and disablement runs when either check fails.
Prek autoupdate permissions and merging .github/workflows/prek_autoupdate.yml, .github/workflows/prek-autoupdate-auto-merge.yml	The autoupdate workflow uses job-level read-only contents access and enables automatic merging. The separate prek auto-merge workflow was deleted.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: ⚪ Minimal · up to 2c34d

This change updates dependency automation and the lockfile without any identified merge-blocking correctness, security, availability, or deployment risk; it is merge-ready after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary changes to the dependency auto-merge workflows, including Dependabot and prek automation updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

The PR modernizes dependency-update automation and refreshes transitive npm dependencies within existing declared ranges.

• Splits Dependabot metadata and changed-file verification into independent jobs and revokes stale auto-merge requests when verification fails.
• Delegates prek update auto-merge to the update action and removes the standalone auto-merge workflow.
• Refreshes compatible transitive dependencies in package-lock.json.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/dependabot-auto-merge.yml	Adds independent Dependabot metadata and file-scope gates, requiring both before enabling auto-merge.
.github/workflows/prek-autoupdate-auto-merge.yml	Removes the standalone prek pull-request verification and auto-merge workflow in favor of integrated action behavior.
.github/workflows/prek_autoupdate.yml	Enables the prek action’s integrated auto-merge option and narrows workflow permissions to read-only contents access.
package-lock.json	Refreshes transitive package versions and platform-specific Sharp dependencies without changing declared dependency ranges.

_{Reviews (2): Last reviewed commit: "Merge branch 'main' into chore/update-de..." | Re-trigger Greptile}

[Snuffy2]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.