Standardize Dependabot auto-merge safeguards

[Snuffy2]

Summary

Standardizes Dependabot auto-merge authorization around trusted base content and verified update history, so dependency PR heads are not executed before their provenance and scope are validated.

What Changed

• Added a shared authorization helper that derives supported dependency ecosystems and eligible files from the trusted base revision.
• Updated Dependabot auto-merge to use the trusted-base helper for every eligible Dependabot PR, including verified GitHub Update-branch chains.
• Added the same pre-checkout authorization gate to Node CI for Dependabot pull requests.
• Added behavior-level coverage for lockfile-only npm updates, trusted-base boundaries, and valid and invalid update chains.

Why

The previous policy duplicated static assumptions about allowed update shapes. Resolving policy from the checked-out base revision keeps authorization fail-closed when repository tooling changes while allowing Dependabot's legitimate lockfile-only and Update-branch flows.

Validation

• npm run testonly
• prek run --all-files (including actionlint)

Review follow-up

• Authorization now derives from verified commit history, so reopened pull requests do not depend on the triggering actor or action.
• Every GitHub Update branch merge second parent requires compare evidence proving it belongs to the exact current base history.
• Dedicated auto-merge and normal CI route every Dependabot-authored pull request through the trusted-base helper; invalid provenance fails closed before pull-request-head checkout.
• Pull-request-head execution is read-only, while write-capable jobs are checkout-free and authorization-dependent.
• Parsed semantic workflow contracts and executable positive/negative history fixtures cover these safeguards without cosmetic workflow snapshots.
• Final validation: 13 focused tests, 264 full Vitest tests, Go race tests, prek, and actionlint passed.
• Authenticated root commits now require a dependabot[bot] author and a verified web-flow committer, matching live GitHub payloads.
• Both authorization evidence collectors now receive BASE_SHA through their environment.
• Behavioral fixtures cover missing and maintainer committers without brittle workflow snapshots.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: b174cffc-5529-4111-8cf0-685e31abdb58

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR centralizes Dependabot authorization in a trusted-base helper and applies it before dependency PR heads are checked out or made eligible for auto-merge.

• Validates Dependabot provenance, supported ecosystems, changed-file scope, and verified commit history.
• Proves every Update-branch merge second parent belongs to the current base history.
• Allows valid reopened dependency updates without relying on the triggering actor or action.
• Adds behavior and workflow-contract tests for authorization and checkout boundaries.

Confidence Score: 5/5

The PR appears safe to merge; both previous findings are resolved and no actionable new defect remains.

The authorization no longer depends on the event action, and every Update-branch merge second parent must be proven to be an ancestor of the exact current base before head checkout or write-capable auto-merge operations proceed. Both previous review threads are resolved.

Important Files Changed

Filename	Overview
.github/scripts/dependabot-auto-merge.mjs	Implements fail-closed Dependabot provenance, file-scope, commit-history, and base-ancestry authorization.
.github/workflows/ci.yml	Authorizes Dependabot pull requests from trusted base content before checking out their heads.
.github/workflows/dependabot-auto-merge.yml	Gates write-capable auto-merge operations on successful trusted-base authorization.
ui/dependabot_auto_merge_test.js	Covers direct and Update-branch histories, reopened events, ancestry evidence, provenance, and ecosystem scope.
ui/dependabot_workflow_contract_test.js	Verifies workflow permissions, trusted checkout ordering, authoritative API dataflow, and write-job dependencies.

_{Reviews (2): Last reviewed commit: "fix: verify Dependabot merge ancestry" | Re-trigger Greptile}