fix(ci): keep bot dependency PRs labeled and rebased automatically

.claude/settings.json

@@ -42,13 +42,10 @@
       "Bash(git commit --no-gpg-sign:*)",
       "Bash(git commit -c commit.gpgsign=false:*)",
       "Bash(gh pr merge:*)",
-      "Bash(gh pr close:*)",
       "Bash(gh pr edit* --base*)",
       "Bash(gh pr edit* --add-reviewer*)",
       "Bash(gh pr edit* --remove-reviewer*)",
       "Bash(gh pr edit* --milestone*)",
-      "Bash(gh pr edit* --add-label*)",
-      "Bash(gh pr edit* --remove-label*)",
       "Bash(gh workflow:*)",
       "Bash(gh secret:*)",
       "Bash(gh api graphql*mutation*)",

.github/mergify.yml

@@ -18,7 +18,23 @@ shared:
         - -merged
         - -closed
 
+  # Authored by Dependabot or Renovate
+  is_dependency_bot: &is_dependency_bot
+    - or:
+        - "author=dependabot[bot]"
+        - "author=renovate[bot]"
+
 pull_request_rules:
+  - name: Keep Dependabot/Renovate PRs up to date with main
+    conditions:
+      - and: *is_open
+      - and: *is_default_branch
+      - and: *is_dependency_bot
+      - "-conflict"
+      - "#commits-behind>0"
+    actions:
+      update:
+
   - name: Trigger workflow dispatch on PR synchronized by github-actions[bot]
     conditions:
       - and: *is_a_bot

pkg/workflow/control_matrix.go

@@ -17,10 +17,14 @@ func expandMatrix(matrix map[string][]string) []map[string]string {
 	sort.Strings(axes)
 	rows := []map[string]string{{}}
 	for _, axis := range axes {
-		next := make([]map[string]string, 0, len(rows)*len(matrix[axis]))
+		// Capacity hint uses a single len() — CodeQL's allocation-size-overflow rule
+		// flags len(rows)*len(matrix[axis]); append grows the slice as needed.
+		next := make([]map[string]string, 0, len(rows))
 		for _, row := range rows {
 			for _, value := range matrix[axis] {
-				copied := make(map[string]string, len(row)+1)
+				// Size the map from a single len() — CodeQL flags len(row)+1; the map
+				// grows as needed for the extra axis key.
+				copied := make(map[string]string, len(row))
 				for k, v := range row {
 					copied[k] = v
 				}

renovate.json

@@ -3,6 +3,8 @@
   "extends": [
     "config:recommended"
   ],
+  "labels": ["no-release"],
+  "rebaseWhen": "behind-base-branch",
   "customManagers": [
     {
       "customType": "regex",