Dependabot: auto-merge green pip updates through their own GitHub App, after a cooldown #740

What

Auto-merge Dependabot's pip PRs once they are green, as marola-merge-bot, from one scheduled workflow in this repo. Decided with the maintainer (2026-10-10), identity per MIP-0086 (#787, task 13):

• pip only; GitHub Actions bumps stay manual (just deps-merge, as today). Today that is marola-ml alone; marola and marola-app have only github-actions, and site, corpus, oods and the devkit have no Dependabot config.
• The token has no Workflows permission. marola-merge-bot holds Workflows write for the devkit bumps, so this job mints its token without permission-workflows: GitHub then refuses to merge a PR that touches .github/workflows/ through it (MIP-0086 §5.5). deps-merge --unattended refuses such a PR first anyway.
• A cooldown first. A hijacked PyPI release (ultralytics, December 2024) would otherwise land on main the day it is published. marola-ml's Dependabot waits 7 days (Dependabot waits 7 days before it proposes an update (cooldown) marola-ml#80, merged).

Done so far: the cooldown (marola-dev/marola-ml#80) and deps-merge --repo OWNER/REPO --unattended (marola-dev/marola-devkit#150, released in devkit v0.18.0). That mode merges a PR only when Dependabot authored it and every commit, it has no hold label, it changes only Python manifests, every version moves by a patch or minor (read from the diff; a 0.x minor counts as major), and every check is green; the merge is pinned to the checked head commit.

Built in this repo (#878):

• .github/workflows/deps-merge.yml: on a schedule (daily, off :00) and workflow_dispatch. One job: exits early on vars.AUTO_MERGE == 'false'; mints a marola-merge-bot token with marola-dev/marola-devkit/.github/actions/bot-token@v0.18.0 (MERGE_BOT_APP_ID / MERGE_BOT_KEY), repositories: marola-ml, Contents and Pull requests write, Checks and Commit statuses read, no Workflows; clones marola-devkit at v0.18.0 (git clone -b, a pin bump-consumers moves) and runs scripts/deps-merge.sh --repo marola-dev/<repo> --unattended for each repo in a list in the file (marola-ml today).
• The file is added to .github/merge-key-allowlist and passes merge-key-check: no nix, installs, curl or third-party actions in the job holding the key. gh and jq come with the runner.
• The bypass comes from the devkit's @consumers extra (MIP-0086 task 3: ruleset-sync's @consumers extra gives marola-merge-bot its bypass marola-devkit#100), so there is no per-repo bypass entry.

The first scheduled runs refused marola-dev/marola-ml#90 (pip only, every version a minor, its newest checks green) for two faults in deps-merge --unattended (devkit v0.20.2):

• Old cancelled checks count. The PR workflow started 3 times when Dependabot opened Bump docker/setup-buildx-action from 3 to 4 #90; concurrency cancelled 2 and the third passed. statusCheckRollup lists all 3, so the 2026-10-19 run said #90 refused: checks not green (CANCELLED) (https://github.com/marola-dev/marola/actions/runs/39271329592). marola-ml#78 hit the same in deps-merge gains an unattended mode for Dependabot pip PRs marola-devkit#176's dry run.
• mergeable is UNKNOWN on the first read. GitHub computes it only when asked, so the 2026-10-20 run said #90 refused: not mergeable (UNKNOWN) (https://github.com/marola-dev/marola/actions/runs/39424647913). A read a few seconds later says MERGEABLE.

Left, in marola-devkit (scripts/deps-merge.sh, both modes):

• Judge a PR by the newest run of each check only: per workflow and check name, the entry with the highest job id in its detailsUrl (a re-run gets a new job id too). A status context keeps its newest startedAt.
• On UNKNOWN, read mergeable again (a few tries, a few seconds apart) before it refuses.
• Self-test cases for both: Bump docker/setup-buildx-action from 3 to 4 #90's real rollup, and an UNKNOWN that becomes MERGEABLE (a stub gh on PATH).
• Then a devkit release; bump-consumers moves deps-merge.yml's pin, and a dispatch or the next daily run merges Bump docker/setup-buildx-action from 3 to 4 #90.

Acceptance criteria

• cooldown set in every dependabot.yml with a pip ecosystem (Dependabot waits 7 days before it proposes an update (cooldown) marola-ml#80)
• deps-merge --unattended merges a green patch/minor pip PR and refuses a major, a non-Dependabot author, a file outside the manifests, a red or pending check and a hold label (deps-merge gains an unattended mode: Dependabot author, Python manifests only, patch or minor, green, no hold marola-devkit#150)
• deps-merge.yml exists, is in .github/merge-key-allowlist, mints without Workflows permission, and exits early on AUTO_MERGE == 'false'
• just quality green, including actionlint and merge-key-check
• a workflow_dispatch run on main lists marola-ml's open Dependabot PRs and merges or refuses each with its reason (https://github.com/marola-dev/marola/actions/runs/39066498995)
• deps-merge judges a PR by the newest run of each check and reads an UNKNOWN mergeable again before it refuses (fix(deps-merge): ignore superseded cancelled checks marola-devkit#198, v0.20.3; the unattended merge also passes --admin, fix(deps-merge): the unattended merge passes --admin marola-devkit#200, v0.20.4); deps-merge.yml pins v0.20.4 (chore: marola-devkit v0.20.4 #909)
• one live auto-merge of a marola-ml Dependabot PR: Bump the "marola-ml-deps" group with 2 updates across multiple ecosystems marola-ml#90, merged by marola-merge-bot at 2026-10-20 21:26Z (https://github.com/marola-dev/marola/actions/runs/39500348051); marola-ml main CI green on e63f0ad

Named test

merge-key-check and actionlint on .github/workflows/deps-merge.yml (in just quality); deps-merge.sh --self-test in marola-devkit v0.18.0 and in the release with the fix; the dispatch run's link and the live merge's link.

Docs, AGENTS.md's pointer and NEW-REPO's day-one setup: #741.