Repository navigation
Conversation
dinakarjs
requested review from
a team,
carloshvp and
imran-siddique
as code owners
October 15, 2026 02:29
Contributor
|
🟡 Contributor Check: MEDIUM
Automated check by AgenTrust Contributor Check. |
github-actions
Bot
added
the
needs-review:MEDIUM
imran-siddique
approved these changes
Oct 15, 2026
imran-siddique
left a comment
imran-siddique
left a comment
Member
There was a problem hiding this comment.
Verified at fb1aec9: the workflow is byte-identical to the copies now on the cmcp, ca2a, agent-manifest, trace-spec, agentrust-telemetry and weight-custody-manifest branches, and the dependabot/fetch-metadata pin resolves to the v3.1.0 tag.
Member
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The current workflow queues auto-merge for every Dependabot PR, including majors, and does not rerun when Dependabot updates a PR. This adds
synchronize, verifies Dependabot metadata with a SHA-pinned action, and queues only nonempty groups whose every update is classified as semver minor or patch. Major, unknown and malformed metadata stays manual; the merge command matches the event head SHA.Ports the safeguards prepared in weight-custody-manifest#196 in response to @rajnisht7's review on weight-custody-manifest#192. Corrects the root and examples pip comments to reflect their existing major-version ignore policy. No dependency policy, approval requirement or branch protection is changed.
Validation: 43 root tests passed, including 15 shell/metadata controls using real Bash and jq with a stubbed gh command; targeted Ruff and formatting checks passed; all 47 integration manifests, compatibility validation, generated index/catalog checks and
git diff --checkpassed. The new tests run in the existing validation workflow with its hash-locked dependencies.The bot-specific path is not exercised by this human-authored PR. After integration, validate a genuine Dependabot run and confirm current-head approval and required checks still block merging.