ci: group Dependabot minor and patch updates and queue auto-merge

[imran-siddique]

69 of the 92 open PRs across agentrust-io are Dependabot's, one per package. This groups minor and patch updates into one PR per ecosystem per week, which is two to four a week per repo.

• .github/dependabot.yml: a catch-all minor/patch group on each pip and github-actions entry, replacing the narrower codeql-action group. Majors still arrive one at a time. Docker digest entries are unchanged.
• .github/workflows/dependabot-auto-merge.yml: runs gh pr merge --auto --squash on Dependabot PRs. It approves nothing. A maintainer still approves the head commit, and gate plus the branch rules still apply. Once that happens and CI is green, GitHub merges without anyone coming back to click.

🤖 Generated with Claude Code

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[carloshvp]

Reviewed exact head e2aecd57df027023ef3c1fec17ac72ae8995a5e0 in an isolated checkout.

Required repository-policy correction: CONTRIBUTING.md, Developer certificate of origin requires a Signed-off-by trailer on every commit. e2aecd57df027023ef3c1fec17ac72ae8995a5e0 have none. Please add the author's DCO sign-off to each commit; the Co-Authored-By trailer does not provide that certification.

Validation: 26 checks against the actual workflow and Dependabot configuration. The eligibility guard admits same-repository dependabot[bot] PRs and rejects human, spoofed-name and fork controls. The workflow checks out no PR content, passes the URL through the environment and only queues squash auto-merge; it grants no approval or administrator bypass. The catch-all groups contain only minor/patch updates; existing schedules, directories, limits, ignore rules and Docker digest/minor policy are unchanged. Actionlint v1.7.12, diff checks and a clean merge simulation passed.

The focused repository OIDC/release-validation checks passed: 13 tests.

Live main-branch rules require independent code-owner/current-push approval, resolved review threads and the maintainer gate; repository auto-merge is enabled. I did not dispatch or claim a live Dependabot merge: the first eligible event still needs operational observation. Only the gate is currently a required status check, so other CI failures still need maintainer attention before approval.

Requesting changes only for the missing required DCO sign-off; I found no blocking defect in the workflow/configuration changes reviewed.

[carloshvp]

Re-reviewed exact head 50a1e2b0d232982338178dd6efaaf97b047fc78c in an isolated checkout. The earlier DCO blocker is resolved: both commits in the PR now carry Signed-off-by trailers.

The revised workflow reads verified Dependabot metadata from the SHA-pinned v3.1.0 action, examines every dependency in the group, and queues only fully classified minor/patch updates. Major, mixed-major, unknown, missing and malformed metadata stay manual. The same-repository Dependabot eligibility guard is retained, no PR content is checked out, and the merge command uses --match-head-commit for the triggering head. It neither approves the PR nor uses an administrator bypass.

Validation: 37 independent checks passed, comprising 21 executions of the actual shell guard with a local gh stub, six eligibility controls, and ten configuration/sign-off checks. These cover grouped update types, invalid metadata, quoted inputs, exact merge arguments, unchanged Docker/ignore/schedule policies and minor/patch-only grouping. Actionlint 1.7.12 with ShellCheck 0.11.0, diff checks and a clean merge simulation against main b3220e468a9a456d1676e25f9b8b1b5785bdd208 also passed.

Local focused tests passed 14 cases; the 14 Linux-specific shell cases were skipped on macOS. The hosted Python 3.11/Linux run at this exact head passed all 15 new Dependabot workflow tests and reported 843 passed, 2 skipped overall. I did not rerun the full runtime suite locally.

Live main-branch rules now require the maintainer gate, all six Linux/Windows Python matrix checks and governance, plus independent code-owner/current-push approval and resolved review threads. Repository auto-merge is enabled. The genuine Dependabot-triggered path still needs operational observation after landing; this human-authored PR correctly skips the enable job.

Approving this head; this supersedes my earlier changes request.