Autonomous repo maintenance: scheduled CI on main, Dependabot coverage, auto-merge, stale bot

[Kravalg]

Description

As a maintainer of php-service-template, I want the repository to maintain itself between pull requests so that bit-rot, new dependency CVEs and aging pinned versions are detected and remediated without waiting for a human to open a PR. Today every quality workflow in .github/workflows/ triggers on pull_request only, so main can silently break or accumulate vulnerable dependencies for weeks. .github/dependabot.yml covers only the composer and npm ecosystems, leaving SHA-pinned GitHub Actions (e.g. actions/checkout@34e11487...) and pinned Docker base images (frankenphp:1-php8.3.17-alpine, structurizr/lite:2024.07.02, localstack:3.4.0) to age unnoticed.

Even when automated PRs are green, they cannot land: Dependabot and template-sync PRs are blocked on the single hardcoded reviewer (Kravalg in .github/dependabot.yml), there is no auto-merge, and there is no stale issue/PR automation. Finally, the template-sync and autorelease workflows — core template deliverables — have no tests of their own, unlike the Makefile which is covered by the bats suites under tests/CLI/bats/.

Affected quality attributes

This issue is part of the enterprise quality audit (report: docs/audit/enterprise-quality-audit-2026-07.md on branch claude/enterprise-quality-audit-bc8jch).

• Autonomy — current 4/5, no scheduled CI on main, no auto-merge, Dependabot misses github-actions/docker — target 5/5
• Self-sustainability — current 4/5, CVEs and bit-rot surface only when someone opens a PR; no stale issue/PR management — target 5/5
• Sustainability — current 4/5, high bus factor: every automated PR requires the single hardcoded reviewer — target 5/5
• Upgradability — current 4/5, pinned actions and base images never receive automated updates — target 5/5
• Timeliness — current 3/5, no scheduled workflow exercises the build or heavier checks between PRs — target 5/5
• Relevance — current 4/5, the 20 CI workflows (template-sync, autorelease) are themselves untested — target 5/5

Tasks

• Add a scheduled maintenance workflow (e.g. .github/workflows/scheduled-ci.yml) with a weekly on: schedule cron that runs make ci and make check-security against main, with failure notifications (e.g. auto-opened issue or Slack/webhook step) so breakage is surfaced without a PR
• Extend .github/dependabot.yml with package-ecosystem: github-actions and package-ecosystem: docker entries (grouped, conventional-commit prefixes consistent with the existing composer/npm entries) so SHA-pinned actions and base images in Dockerfile/compose.yaml receive automated updates
• Add an auto-merge workflow for green grouped Dependabot PRs (gh pr merge --auto gated on all required checks passing), so routine dependency bumps land without the hardcoded reviewer being the bottleneck
• Add actions/stale configuration for stale issue/PR hygiene with conservative timeouts and exempt labels
• Add bats tests under tests/CLI/bats/ (mirroring the existing suites such as make_validate_configuration_tests.bats) covering the sync/release script logic used by .github/workflows/template-sync-app.yml, tempate-sync-pat.yml and autorelease.yml; extract inline workflow shell into testable scripts where needed
• Add actionlint to CI so the workflow files themselves are validated on every PR
• Update documentation (README.md, .github/TEMPLATE_SYNC_APP.md / TEMPLATE_SYNC_PAT.md where relevant) to describe the new scheduled maintenance and auto-merge behavior

Note: DAST/fuzzing coverage in CI is tracked separately in #11 and is out of scope here; AI-agent documentation sync is tracked in #171.

Acceptance Criteria

• A cron-scheduled workflow runs make ci and make check-security on main at least weekly and produces a visible failure notification when either fails
• .github/dependabot.yml includes github-actions and docker ecosystems and Dependabot opens update PRs for pinned actions and base images
• Green grouped Dependabot PRs merge automatically once all required checks pass, without manual reviewer action
• actions/stale is active with documented labels/timeouts
• New bats suites for the sync/release scripts pass via the existing bats runner, and actionlint passes on all workflows
• All existing quality gates still pass (make ci)
• The linked PR passes GitHub CI checks and CodeRabbit review feedback is addressed
• No existing quality gate or threshold is lowered — thresholds may only be added or raised

[coderabbitai]

🔗 Related PRs

#40 - implement cloud based load testing with k6 [merged]
#57 - update Readme, fix GitHub action, move AUTORELEASE.md [merged]
#135 - Rector php [merged]
#172 - feat(#171): synchronize AI agent support baseline [merged]
#175 - feat(#174): sync README and FrankenPHP enterprise baseline [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!