Dependabot auto-merge: mnemonic

[zircote]

mnemonic: enable Dependabot auto-merge

Part of the org-wide rollout (see the tracking epic).

• Enable allow_auto_merge: true on the repo
• Add the thin SHA-pinned caller of .github reusable-dependabot-automerge.yml
• Confirm branch protection: the App approval satisfies the required review; conversation-resolution honored
• Verify: a real Dependabot patch/minor PR with green required checks auto-merges

If mnemonic has no Dependabot config / no CI, scope down to enabling the setting, or close as N/A with rationale.

[zircote]

Held on a pre-existing CI problem. mnemonic's ci.yml pins actions/checkout@v7 (a tag, not a 40-char SHA), which violates the org SHA-pinning policy, so the CI workflow startup-fails on every run and the repo has no working required check. Enabling auto-merge here would let Dependabot PRs merge with no CI gate, so I'm not enabling it. Caller PR #32 is open but unmerged.

Next step to unblock: SHA-pin mnemonic's workflow actions so ci.yml runs, make it a required check, then merge #32 and apply settings. The one open Dependabot PR (#30) is an internal .github SHA bump (non-semver), which stays manual regardless.

[zircote]

Diagnosis update — held, blocked on a pre-existing CI problem (separate from the auto-merge work).

Every Actions workflow in mnemonic startup-fails; only Copilot (an app) runs. Confirmed: the push-CI run on main (5896e2e) startup-failed with ci.yml's unpinned actions. Causes:

• ci.yml pins actions/checkout@v7 and actions/setup-python@v6 by tag → rejected by the org sha_pinning_required policy.
• claude.yml and claude-code-review.yml use anthropics/claude-code-action, which is not on the org Actions allow-list.

So mnemonic has no working required check. Auto-merge is NOT enabled here, because without a green required check Dependabot PRs would merge ungated. I pushed a ci.yml pin fix to PR #32, but bringing mnemonic CI fully green and required is a focused CI-repair task beyond this rollout.

To unblock: pin ci.yml on main; allow-list or remove the claude workflows; make CI a required check; then merge #32 and apply settings.

[zircote]

Done. CI repaired (ci.yml SHA-pinned so it runs under the org pinning policy; PR #33 merged), auto-merge enabled (allow_auto_merge on; required checks: Validate Plugin, Lint, Format Check, Test, Security Audit), and the open Dependabot PR #30 was rebased onto the fixed CI and merged. Patch auto-merge is live. Note: claude.yml / claude-code-review.yml still fail separately (they use anthropics/claude-code-action, not on the org allow-list) — they are not gates, so they do not affect auto-merge.