ci: pin pr-automerge-dependabot to ci-workflows v0.50.0

[kyle-sexton]

No related issue: org rollout of package auto-merge after melodic-software/ci-workflows#783

Summary

Pins the shared Dependabot auto-merge caller to ci-workflows v0.50.0, which adds npm, pip and NuGet patch and minor auto-merge. Majors still wait for review.

Fix

One line in .github/workflows/pr-automerge-dependabot.yml: @ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3 becomes @d223a6446680fb261e264d1dea9efba46f20ead2 # v0.50.0. The runner: input is unchanged and no new inputs are passed.

Verification

Diff is exactly one line. This repo has no .github/standards/runner-policy/policy.json on its default branch, so there is no runner-policy copy to check.

Related

• feat(automerge): arm npm, pip and NuGet patch and minor Dependabot bumps ci-workflows#783
• https://github.com/melodic-software/ci-workflows/releases/tag/v0.50.0
• feat(policy): admit ci-workflows v0.50.0 and auto-merge npm/pip/nuget standards#809

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T01:22:22.607210Z	18ce5af	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed 18ce5af5879c4dad42767f49c467cf074dd441d7: 0 finding(s), 0 as inline comments.

No findings.

The diff is one line in .github/workflows/pr-automerge-dependabot.yml. It moves the reusable-workflow pin from ab83b01…# v0.39.3 to d223a64…# v0.50.0. The with: runner: ubuntu-24.04 input and the contents: write and pull-requests: write permissions are unchanged.

• Not verified: I could not confirm that d223a6446680fb261e264d1dea9efba46f20ead2 is the commit v0.50.0 points to. My gh api call to ci-workflows was not approved in this session. The SHA-to-tag match rests on the author's claim.
• Not verified: I could not check that v0.50.0 adds no new required inputs or permissions for the caller. The PR says none are needed.
• Closing issue: none. The PR uses the "No related issue" escape with a reason, so there are no acceptance criteria to check.
• Security scope: the pin is a full-length commit SHA with a version comment, which is the right pinning style. A broader review of what v0.50.0 does with contents: write belongs to the security lane.

[github-actions]

claude-security-review reviewed 18ce5af5879c4dad42767f49c467cf074dd441d7: 0 finding(s), 0 as inline comments.

Security review: PR #120 (head 18ce5af)

Findings: 0.

The diff changes one line in .github/workflows/pr-automerge-dependabot.yml. It moves the reusable workflow pin from ab83b01… (v0.39.3) to d223a64… (v0.50.0).

• The new ref is still a full 40-character commit SHA, so the pin is not loosened.
• The permissions: block is unchanged (contents: write, pull-requests: write). Nothing is widened.
• The trigger, the with: inputs and the runner are unchanged.
• The source is the same org's ci-workflows repo.
• No instruction-surface files (CLAUDE.md, AGENTS.md, skills, hooks) are touched.

I did not confirm that SHA d223a64… is the commit the v0.50.0 tag points to. The sandbox blocked the gh api call for that lookup. The pin hygiene and any pin-drift checks belong to zizmor's lane.