[0thernet]

Why

A pre-existing Dependabot auto-merge request can merge with GITHUB_TOKEN as soon as the PR Required check passes, racing the app-token workflow_run merge and suppressing Check on the new main commit. PR #521 had a green PR-head check, but its exact main SHA has no Check/Required run.

Change

• On Check requested, clear an existing auto-merge request only for an open, same-repo Dependabot PR at the exact checked head, with a separate pull-requests: write cleanup job.
• Hold the PR Required gate (read-only token) until no competing request remains; fail closed on stale heads or unsuccessful cleanup.
• Keep the completed-phase exact-head, successful-Check merge through the existing app token; do not expose the app secret to PR CI.

Validation

• python3 -I .github/scripts/dependabot-auto-merge.test.py (9 passed)
• actionlint .github/workflows/ci.yml .github/workflows/dependabot-auto-merge.yml
• git diff --check and git diff --cached --check

Live acceptance requires the next naturally qualifying Dependabot merge to produce a successful Check/Required run on its exact main SHA; this PR alone does not establish that. No release or host-install claim is made.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
xcb	Ignored		Oct 18, 2026 10:43pm UTC