ci: pin pr-automerge-dependabot to ci-workflows v0.50.0

[kyle-sexton]

No related issue: org rollout of package auto-merge after melodic-software/ci-workflows#783

Summary

Pins the shared Dependabot auto-merge caller to ci-workflows v0.50.0, which adds npm, pip and NuGet patch and minor auto-merge. Majors still wait for review.

Fix

One line in .github/workflows/pr-automerge-dependabot.yml: @ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3 becomes @d223a6446680fb261e264d1dea9efba46f20ead2 # v0.50.0. The runner: input is unchanged and no new inputs are passed.

Verification

Diff is exactly one line. This repo has no .github/standards/runner-policy/policy.json on its default branch, so there is no runner-policy copy to check.

Related

• feat(automerge): arm npm, pip and NuGet patch and minor Dependabot bumps ci-workflows#783
• https://github.com/melodic-software/ci-workflows/releases/tag/v0.50.0
• feat(policy): admit ci-workflows v0.50.0 and auto-merge npm/pip/nuget standards#809

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T01:24:09.635477Z	d04eb2c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed d04eb2cad62b62f951e99574510962144b19beef: 0 finding(s), 0 as inline comments.

Security review: PR #140 (head d04eb2c)

Result: no security findings. The review reported nothing and posted nothing to the PR.

Change reviewed: the only change is in .github/workflows/pr-automerge-dependabot.yml. It bumps the uses: pin on the org's reusable pr-automerge-dependabot workflow from ab83b01… (v0.39.3) to d223a64… (v0.50.0).

• Pin: The new reference is still a full commit SHA with a version comment, so the pinning discipline is unchanged. Pin hygiene is zizmor's lane, so it is not re-reported here.
• Permissions: contents: write and pull-requests: write are the same as before, and the caller's input is still just runner: ubuntu-24.04. The caller's trust surface does not widen.
• Instruction surface: The diff deletes or softens no instruction, rule, hook or allowlist. The instruction-exception register was not needed.

Not checked:

• I did not read the v0.50.0 workflow's contents, which live in another repository. The PR description says it adds npm, pip and NuGet patch and minor auto-merge, with majors still waiting for review. That widened auto-merge behavior is worth confirming in ci-workflows#783.
• I did not confirm that d223a64… is the v0.50.0 tag, because the tag lookup was blocked in this session.

[github-actions]

claude-review reviewed d04eb2cad62b62f951e99574510962144b19beef: 0 finding(s), 0 as inline comments.

Review of #140 (ci: pin pr-automerge-dependabot to ci-workflows v0.50.0)

Findings: 0 inline. The diff is one line. It changes the uses: pin in .github/workflows/pr-automerge-dependabot.yml from v0.39.3 to v0.50.0. The pin is still a full commit SHA with a version comment, and the runner: input and permissions are unchanged. Nothing in the diff fails the correctness bar.

Not verified. I could not confirm that d223a6446680fb261e264d1dea9efba46f20ead2 is the commit v0.50.0 points to. The gh api call to resolve the tag was blocked pending approval, so I did not run it. The check is worth doing before merge. The PR description says only that the diff is one line. That is author-claimed, not something I checked against the tag.

Advisory, not blocking: the header comment is now stale. Lines 3-5 of the workflow file (unchanged lines, so I could not anchor a comment) still say the workflow arms auto-merge only for Dependabot PRs bumping allowlisted GitHub Actions publishers (actions/*, github/*, anthropics/*). The PR description says v0.50.0 also auto-merges npm, pip and NuGet patch and minor bumps. This repo uses npm (npm test, npm run validate). If that description holds, the comment now understates what this caller arms. Permalink:

codex-plugins/.github/workflows/pr-automerge-dependabot.yml

Lines 3 to 10 in d04eb2c

	# Thin caller of the org's reusable that arms GitHub auto-merge (squash) on a
	# Dependabot pull request bumping only allowlisted GitHub Actions publishers
	# (`actions/*`, `github/*`, `anthropics/*`) by a patch or minor version. Arming
	# never merges: GitHub merges once every required check, `ci-status` included,
	# passes. The caller owns the trigger, concurrency and the permission grant; a
	# called workflow can only downgrade the caller's grant. Runs on the
	# GitHub-hosted `ubuntu-24.04` runner, which the runner-policy admits on a
	# public repository.

. Update the comment, or confirm the new ecosystems do not apply here.

Closing issue. None. The PR states No related issue: …, so there are no acceptance criteria to check.

PR body contract (.claude/rules/pr-body-contract.md): the body has the No related issue: <reason> line and the Summary, Fix, Verification and Related sections. It matches.

AGENTS.md preflight. The plugin documentation preflight (consulted URLs and date) applies to plugin component changes. This is a CI-only change, so I did not treat its absence as a finding.