[kyle-sexton]

No related issue: org rollout of package auto-merge after melodic-software/ci-workflows#783

Summary

Pins the shared Dependabot auto-merge caller to ci-workflows v0.50.0, which adds npm, pip and NuGet patch and minor auto-merge. Majors still wait for review.

Fix

One line in .github/workflows/pr-automerge-dependabot.yml: @ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3 becomes @d223a6446680fb261e264d1dea9efba46f20ead2 # v0.50.0. The runner: input is unchanged and no new inputs are passed.

Verification

Diff is exactly one line. This repo has no .github/standards/runner-policy/policy.json on its default branch, so there is no runner-policy copy to check.

Related

• feat(automerge): arm npm, pip and NuGet patch and minor Dependabot bumps ci-workflows#783
• https://github.com/melodic-software/ci-workflows/releases/tag/v0.50.0
• feat(policy): admit ci-workflows v0.50.0 and auto-merge npm/pip/nuget standards#809

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T01:22:38.486814Z	b5ecade	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed b5ecadeb5ddb6b9967b4ccf63ac790fa2a8131d3: 0 finding(s), 0 as inline comments.

Security review: PR #102

Result: no security findings.

The PR changes one line in .github/workflows/pr-automerge-dependabot.yml. It moves the reusable-workflow pin for melodic-software/ci-workflows from ab83b01… (v0.39.3) to d223a64… (v0.50.0).

• Pin form: the new reference is still a full 40-character commit SHA with a version comment, so the pin is no looser than before.
• Permissions and triggers: the diff doesn't touch the job's permissions: block (contents: write, pull-requests: write) or the workflow triggers.
• Supply-chain angle: pin bumps are zizmor's advisory lane, so I didn't report them here.
• Not verified: I didn't confirm that SHA d223a64… is the commit the v0.50.0 tag points to. The check was blocked by the permission gate, and I did not retry it another way. A mismatch would not widen what the job can do, but a maintainer can compare the two with gh api repos/melodic-software/ci-workflows/git/ref/tags/v0.50.0.
• Instruction surfaces: the diff touches none, so the instruction-exception register wasn't needed.

[github-actions]

claude-review reviewed b5ecadeb5ddb6b9967b4ccf63ac790fa2a8131d3: 0 finding(s), 0 as inline comments.

No findings.

The PR changes one line in .github/workflows/pr-automerge-dependabot.yml. It bumps the reusable workflow pin from v0.39.3 to v0.50.0 by full commit SHA, with the version comment updated to match. The permissions block and the runner: input are unchanged, and no new inputs are passed.

• Unverified: I couldn't check that d223a6446680fb261e264d1dea9efba46f20ead2 is the commit the v0.50.0 tag points to. The gh api call was not approved in this session. The PR body doesn't claim that check either.
• Not reviewed: I didn't read the v0.50.0 release behavior (npm, pip and NuGet patch and minor auto-merge). That is the PR author's claim, and the code is in another repository.
• Closing issue: the PR uses the no-issue escape, "No related issue: …", so there are no acceptance criteria to check.
• Embedded instructions: the PR body contains none.
• Paved paths and path-scoped rules: I didn't read the standards index or the .claude/rules/ files. I didn't spot-check these for a one-line SHA bump.