From 4a47606071d8841f8c5bd4884fc76881bb4dacb8 Mon Sep 17 00:00:00 2001 From: SteveBot <1153461+unbraind@users.noreply.github.com> Date: Sun, 4 Oct 2026 18:55:57 +0200 Subject: [PATCH 1/4] Auto-merge green Dependabot updates and group the pm toolchain into one daily PR Version bumps of @unbrained/pm-cli, pm-ops and pm-changelog are mechanical. Dependabot now checks npm daily and groups the pm toolchain (and other minor/patch updates) into single pull requests; a least-privilege workflow enables squash auto-merge for every non-major Dependabot PR, so it lands as soon as the required checks pass and a failing bump stays open as a defect. pm item: pm-slack-standup-gquv --- .../pm/history/pm-slack-standup-gquv.jsonl | 3 +++ .agents/pm/tasks/pm-slack-standup-gquv.toon | 23 ++++++++++++++++ .github/dependabot.yml | 21 ++++++++++++++- .github/workflows/dependabot-auto-merge.yml | 26 +++++++++++++++++++ 4 files changed, 72 insertions(+), 1 deletion(-) create mode 100644 .agents/pm/history/pm-slack-standup-gquv.jsonl create mode 100644 .agents/pm/tasks/pm-slack-standup-gquv.toon create mode 100644 .github/workflows/dependabot-auto-merge.yml diff --git a/.agents/pm/history/pm-slack-standup-gquv.jsonl b/.agents/pm/history/pm-slack-standup-gquv.jsonl new file mode 100644 index 0000000..3113a03 --- /dev/null +++ b/.agents/pm/history/pm-slack-standup-gquv.jsonl @@ -0,0 +1,3 @@ +{"hash_algorithm":"sha256","ts":"2026-10-04T16:55:55.633Z","author":"claude-orchestrator","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"4b273145923a68729ab394ab","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"high","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.289","source":"probe"}},"op":"create","patch":[{"op":"replace","path":"/body","value":"Fleet-wide automation of version bumps; see companion pm-cli-website-6d05."},{"op":"add","path":"/metadata/id","value":"pm-slack-standup-gquv"},{"op":"add","path":"/metadata/title","value":"Auto-merge green Dependabot updates and group the pm toolchain into one daily PR"},{"op":"add","path":"/metadata/description","value":"Version bumps of the pm CLI, SDK-bearing packages and fleet gates are mechanical and must land without a hand-written certification PR. Dependabot checks npm daily, groups @unbrained/pm-cli and pm-* packages into one pm-toolchain PR and other minor/patch updates into one dependencies PR; a least-privilege workflow enables GitHub squash auto-merge for every non-major Dependabot PR so it merges as soon as the required checks pass. A failing bump is a real defect to fix. Fleet rule: companion pm-cli-website-6d05; pilot unbraind/pm-presets#118."},{"op":"add","path":"/metadata/type","value":"Task"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":2},{"op":"add","path":"/metadata/tags","value":["automation","ci","dependencies"]},{"op":"add","path":"/metadata/created_at","value":"2026-10-04T16:55:55.633Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-10-04T16:55:55.633Z"},{"op":"add","path":"/metadata/deadline","value":"2026-10-06T00:00:00.000Z"},{"op":"add","path":"/metadata/assignee","value":"claude-orchestrator"},{"op":"add","path":"/metadata/author","value":"claude-orchestrator"},{"op":"add","path":"/metadata/estimated_minutes","value":15},{"op":"add","path":"/metadata/acceptance_criteria","value":"dependabot.yml checks npm daily with pm-toolchain and dependencies groups; dependabot-auto-merge.yml enables squash auto-merge only for Dependabot non-major updates with least-privilege permissions; repository allows auto-merge; required checks still gate every merge"},{"op":"add","path":"/metadata/comments","value":[{"created_at":"2026-10-04T16:55:55.633Z","author":"claude-orchestrator","text":"Rolled out from the reviewed pilot unbraind/pm-presets#118."}]},{"op":"add","path":"/metadata/files","value":[{"path":".github/dependabot.yml","scope":"project"},{"path":".github/workflows/dependabot-auto-merge.yml","scope":"project"}]},{"op":"add","path":"/metadata/docs","value":[{"path":".github/workflows/dependabot-auto-merge.yml","scope":"project"}]}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"39b7baeb682b6a7d01ab1b209e03d68822ed0f251be9215fac531fc6f166933e","item_hash_version":3,"message":"Create item for Dependabot auto-merge | explicit_unset=dependencies,learnings,notes,tests","context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"208577a500db838f2b8524de0a9f6a7104c3412dbf34eee08d626872753d601b"} +{"hash_algorithm":"sha256","ts":"2026-10-04T16:55:56.668Z","author":"claude-orchestrator","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"4b273145923a68729ab394ab","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"high","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.289","source":"probe"}},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T16:55:56.668Z"},{"op":"add","path":"/metadata/claim_principal","value":"claude-orchestrator"}],"before_hash":"39b7baeb682b6a7d01ab1b209e03d68822ed0f251be9215fac531fc6f166933e","after_hash":"de13b57c9cfe8c1d681300f268484e1cb9cafd4456170f243386ce89916babc4","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"30626c99580dc55e085c04e6b31925167c89e5b7cf6d124b4817b6ecf91938ba"} +{"hash_algorithm":"sha256","ts":"2026-10-04T16:55:57.394Z","author":"claude-orchestrator","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"4b273145923a68729ab394ab","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"high","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.289","source":"probe"}},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T16:55:57.394Z"},{"op":"replace","path":"/metadata/status","value":"in_progress"}],"before_hash":"de13b57c9cfe8c1d681300f268484e1cb9cafd4456170f243386ce89916babc4","after_hash":"fea3a1cdb7c01f74d32196a4a5b998e59f84f5608ca1edb593b695ee16143701","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"52aac714005ebcf06e5ada1db6d558001e3f0257f2e34e36a70ab12cb25837ae"} diff --git a/.agents/pm/tasks/pm-slack-standup-gquv.toon b/.agents/pm/tasks/pm-slack-standup-gquv.toon new file mode 100644 index 0000000..2445019 --- /dev/null +++ b/.agents/pm/tasks/pm-slack-standup-gquv.toon @@ -0,0 +1,23 @@ +id: pm-slack-standup-gquv +title: Auto-merge green Dependabot updates and group the pm toolchain into one daily PR +description: "Version bumps of the pm CLI, SDK-bearing packages and fleet gates are mechanical and must land without a hand-written certification PR. Dependabot checks npm daily, groups @unbrained/pm-cli and pm-* packages into one pm-toolchain PR and other minor/patch updates into one dependencies PR; a least-privilege workflow enables GitHub squash auto-merge for every non-major Dependabot PR so it merges as soon as the required checks pass. A failing bump is a real defect to fix. Fleet rule: companion pm-cli-website-6d05; pilot unbraind/pm-presets#118." +type: Task +status: in_progress +priority: 2 +tags[3]: automation,ci,dependencies +created_at: "2026-10-04T16:55:55.633Z" +updated_at: "2026-10-04T16:55:57.394Z" +deadline: "2026-10-06T00:00:00.000Z" +assignee: claude-orchestrator +claim_principal: claude-orchestrator +author: claude-orchestrator +estimated_minutes: 15 +acceptance_criteria: dependabot.yml checks npm daily with pm-toolchain and dependencies groups; dependabot-auto-merge.yml enables squash auto-merge only for Dependabot non-major updates with least-privilege permissions; repository allows auto-merge; required checks still gate every merge +comments[1]{created_at,author,text}: + "2026-10-04T16:55:55.633Z",claude-orchestrator,Rolled out from the reviewed pilot unbraind/pm-presets#118. +files[2]{path,scope}: + .github/dependabot.yml,project + .github/workflows/dependabot-auto-merge.yml,project +docs[1]{path,scope}: + .github/workflows/dependabot-auto-merge.yml,project +body: Fleet-wide automation of version bumps; see companion pm-cli-website-6d05. diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 2b876a3..6965fa2 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,8 +3,27 @@ updates: - package-ecosystem: "npm" directory: "/" schedule: - interval: "weekly" + interval: "daily" open-pull-requests-limit: 5 + groups: + # The pm CLI, its SDK-bearing packages and the fleet gates move together + # in one pull request per day; dependabot-auto-merge.yml merges it as soon + # as the required checks pass, so a release bump needs no manual work. + # No update-types filter: pm uses calendar versions, so a year rollover + # (2026.x -> 2027.x) is a semver major that must still land unattended. + pm-toolchain: + patterns: + - "@unbrained/pm-cli" + - "pm-*" + dependencies: + # Disjoint from pm-toolchain, so a pm package can never be bumped + # here (and capped by this group's update-types) instead. + exclude-patterns: + - "@unbrained/pm-cli" + - "pm-*" + update-types: + - "minor" + - "patch" - package-ecosystem: "github-actions" directory: "/" diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml new file mode 100644 index 0000000..12eab3b --- /dev/null +++ b/.github/workflows/dependabot-auto-merge.yml @@ -0,0 +1,26 @@ +name: dependabot-auto-merge + +# Version bumps are mechanical: every non-major Dependabot pull request gets +# GitHub auto-merge, so it lands the moment the required checks pass. Branch +# protection still gates the merge; a failing bump stays open as a defect. +on: pull_request + +permissions: {} + +jobs: + enable-auto-merge: + if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository_owner == 'unbraind' + runs-on: ubuntu-latest + permissions: + contents: write + pull-requests: write + steps: + - id: metadata + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 + # pm-toolchain is calendar-versioned (a new year reads as semver-major), + # so it always auto-merges; any other major update waits for a person. + - if: steps.metadata.outputs.dependency-group == 'pm-toolchain' || steps.metadata.outputs.update-type != 'version-update:semver-major' + run: gh pr merge --auto --squash "$PR_URL" + env: + PR_URL: ${{ github.event.pull_request.html_url }} + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} From a93f698b1a43ea0bcb36380787d26d049bdfe582 Mon Sep 17 00:00:00 2001 From: SteveBot <1153461+unbraind@users.noreply.github.com> Date: Sun, 4 Oct 2026 19:01:47 +0200 Subject: [PATCH 2/4] Close pm-slack-standup-gquv and regenerate the changelog pm item: pm-slack-standup-gquv --- .agents/pm/history/pm-slack-standup-gquv.jsonl | 2 ++ .agents/pm/tasks/pm-slack-standup-gquv.toon | 9 +++++---- CHANGELOG.md | 6 ++++++ 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/.agents/pm/history/pm-slack-standup-gquv.jsonl b/.agents/pm/history/pm-slack-standup-gquv.jsonl index 3113a03..c1205ee 100644 --- a/.agents/pm/history/pm-slack-standup-gquv.jsonl +++ b/.agents/pm/history/pm-slack-standup-gquv.jsonl @@ -1,3 +1,5 @@ {"hash_algorithm":"sha256","ts":"2026-10-04T16:55:55.633Z","author":"claude-orchestrator","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"4b273145923a68729ab394ab","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"high","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.289","source":"probe"}},"op":"create","patch":[{"op":"replace","path":"/body","value":"Fleet-wide automation of version bumps; see companion pm-cli-website-6d05."},{"op":"add","path":"/metadata/id","value":"pm-slack-standup-gquv"},{"op":"add","path":"/metadata/title","value":"Auto-merge green Dependabot updates and group the pm toolchain into one daily PR"},{"op":"add","path":"/metadata/description","value":"Version bumps of the pm CLI, SDK-bearing packages and fleet gates are mechanical and must land without a hand-written certification PR. Dependabot checks npm daily, groups @unbrained/pm-cli and pm-* packages into one pm-toolchain PR and other minor/patch updates into one dependencies PR; a least-privilege workflow enables GitHub squash auto-merge for every non-major Dependabot PR so it merges as soon as the required checks pass. A failing bump is a real defect to fix. Fleet rule: companion pm-cli-website-6d05; pilot unbraind/pm-presets#118."},{"op":"add","path":"/metadata/type","value":"Task"},{"op":"add","path":"/metadata/status","value":"open"},{"op":"add","path":"/metadata/priority","value":2},{"op":"add","path":"/metadata/tags","value":["automation","ci","dependencies"]},{"op":"add","path":"/metadata/created_at","value":"2026-10-04T16:55:55.633Z"},{"op":"add","path":"/metadata/updated_at","value":"2026-10-04T16:55:55.633Z"},{"op":"add","path":"/metadata/deadline","value":"2026-10-06T00:00:00.000Z"},{"op":"add","path":"/metadata/assignee","value":"claude-orchestrator"},{"op":"add","path":"/metadata/author","value":"claude-orchestrator"},{"op":"add","path":"/metadata/estimated_minutes","value":15},{"op":"add","path":"/metadata/acceptance_criteria","value":"dependabot.yml checks npm daily with pm-toolchain and dependencies groups; dependabot-auto-merge.yml enables squash auto-merge only for Dependabot non-major updates with least-privilege permissions; repository allows auto-merge; required checks still gate every merge"},{"op":"add","path":"/metadata/comments","value":[{"created_at":"2026-10-04T16:55:55.633Z","author":"claude-orchestrator","text":"Rolled out from the reviewed pilot unbraind/pm-presets#118."}]},{"op":"add","path":"/metadata/files","value":[{"path":".github/dependabot.yml","scope":"project"},{"path":".github/workflows/dependabot-auto-merge.yml","scope":"project"}]},{"op":"add","path":"/metadata/docs","value":[{"path":".github/workflows/dependabot-auto-merge.yml","scope":"project"}]}],"before_hash":"3cc22dff72be7b14824654a7a64ea62b04799939b2fee54c1b5f52ca60bf6df0","after_hash":"39b7baeb682b6a7d01ab1b209e03d68822ed0f251be9215fac531fc6f166933e","item_hash_version":3,"message":"Create item for Dependabot auto-merge | explicit_unset=dependencies,learnings,notes,tests","context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"208577a500db838f2b8524de0a9f6a7104c3412dbf34eee08d626872753d601b"} {"hash_algorithm":"sha256","ts":"2026-10-04T16:55:56.668Z","author":"claude-orchestrator","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"4b273145923a68729ab394ab","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"high","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.289","source":"probe"}},"op":"claim","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T16:55:56.668Z"},{"op":"add","path":"/metadata/claim_principal","value":"claude-orchestrator"}],"before_hash":"39b7baeb682b6a7d01ab1b209e03d68822ed0f251be9215fac531fc6f166933e","after_hash":"de13b57c9cfe8c1d681300f268484e1cb9cafd4456170f243386ce89916babc4","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"30626c99580dc55e085c04e6b31925167c89e5b7cf6d124b4817b6ecf91938ba"} {"hash_algorithm":"sha256","ts":"2026-10-04T16:55:57.394Z","author":"claude-orchestrator","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"4b273145923a68729ab394ab","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"high","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.289","source":"probe"}},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T16:55:57.394Z"},{"op":"replace","path":"/metadata/status","value":"in_progress"}],"before_hash":"de13b57c9cfe8c1d681300f268484e1cb9cafd4456170f243386ce89916babc4","after_hash":"fea3a1cdb7c01f74d32196a4a5b998e59f84f5608ca1edb593b695ee16143701","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"52aac714005ebcf06e5ada1db6d558001e3f0257f2e34e36a70ab12cb25837ae"} +{"hash_algorithm":"sha256","ts":"2026-10-04T16:58:39.125Z","author":"claude-orchestrator","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"4b273145923a68729ab394ab","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"high","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.289","source":"probe"}},"op":"close","patch":[{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T16:58:39.125Z"},{"op":"replace","path":"/metadata/status","value":"closed"},{"op":"add","path":"/metadata/closed_at","value":"2026-10-04T16:58:38.826Z"},{"op":"add","path":"/metadata/completed_at","value":"2026-10-04T16:58:38.826Z"},{"op":"add","path":"/metadata/close_reason","value":"Rolled out the reviewed pilot (unbraind/pm-presets#118, auto-merge proven on pm-presets#119, groups made disjoint in pm-presets#120). This PR's required checks gate the merge; repository auto-merge and branch deletion enabled."}],"before_hash":"fea3a1cdb7c01f74d32196a4a5b998e59f84f5608ca1edb593b695ee16143701","after_hash":"7955867347cd8d2bc7bf4c5bc45e4b6316fef9011f6b213957cc9dcf07e8d271","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"f7eab9ff88b24066951263c4031e5d3dfb1d2f0e1ebaf39faf8127ac6e7a0b53"} +{"hash_algorithm":"sha256","ts":"2026-10-04T16:58:45.597Z","author":"claude-orchestrator","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"4b273145923a68729ab394ab","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"high","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.289","source":"probe"}},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T16:58:45.597Z"}],"before_hash":"7955867347cd8d2bc7bf4c5bc45e4b6316fef9011f6b213957cc9dcf07e8d271","after_hash":"84f8c12550f45da47586f20e802f42e2c651bc293859b040318345f6c2248636","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"cb3ec96c29d9bbed020070ba44136adb7fd74cd799a587a042e2c969fb2bd9d7"} diff --git a/.agents/pm/tasks/pm-slack-standup-gquv.toon b/.agents/pm/tasks/pm-slack-standup-gquv.toon index 2445019..47a42e6 100644 --- a/.agents/pm/tasks/pm-slack-standup-gquv.toon +++ b/.agents/pm/tasks/pm-slack-standup-gquv.toon @@ -2,14 +2,14 @@ id: pm-slack-standup-gquv title: Auto-merge green Dependabot updates and group the pm toolchain into one daily PR description: "Version bumps of the pm CLI, SDK-bearing packages and fleet gates are mechanical and must land without a hand-written certification PR. Dependabot checks npm daily, groups @unbrained/pm-cli and pm-* packages into one pm-toolchain PR and other minor/patch updates into one dependencies PR; a least-privilege workflow enables GitHub squash auto-merge for every non-major Dependabot PR so it merges as soon as the required checks pass. A failing bump is a real defect to fix. Fleet rule: companion pm-cli-website-6d05; pilot unbraind/pm-presets#118." type: Task -status: in_progress +status: closed priority: 2 tags[3]: automation,ci,dependencies created_at: "2026-10-04T16:55:55.633Z" -updated_at: "2026-10-04T16:55:57.394Z" +updated_at: "2026-10-04T16:58:45.597Z" deadline: "2026-10-06T00:00:00.000Z" -assignee: claude-orchestrator -claim_principal: claude-orchestrator +closed_at: "2026-10-04T16:58:38.826Z" +completed_at: "2026-10-04T16:58:38.826Z" author: claude-orchestrator estimated_minutes: 15 acceptance_criteria: dependabot.yml checks npm daily with pm-toolchain and dependencies groups; dependabot-auto-merge.yml enables squash auto-merge only for Dependabot non-major updates with least-privilege permissions; repository allows auto-merge; required checks still gate every merge @@ -20,4 +20,5 @@ files[2]{path,scope}: .github/workflows/dependabot-auto-merge.yml,project docs[1]{path,scope}: .github/workflows/dependabot-auto-merge.yml,project +close_reason: "Rolled out the reviewed pilot (unbraind/pm-presets#118, auto-merge proven on pm-presets#119, groups made disjoint in pm-presets#120). This PR's required checks gate the merge; repository auto-merge and branch deletion enabled." body: Fleet-wide automation of version bumps; see companion pm-cli-website-6d05. diff --git a/CHANGELOG.md b/CHANGELOG.md index 8ce556c..4fef8d2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog +## Unreleased + +### Other + +- Auto-merge green Dependabot updates and group the pm toolchain into one daily PR ([pm-slack-standup-gquv](https://github.com/unbraind/pm-slack-standup/blob/main/.agents/pm/tasks/pm-slack-standup-gquv.toon)) + ## 2026.9.26 - 2026-09-26 ### Fixed From 593ebcdf6f4ce8d585a85426b17aaa610c9d681c Mon Sep 17 00:00:00 2001 From: SteveBot <1153461+unbraind@users.noreply.github.com> Date: Sun, 4 Oct 2026 19:21:07 +0200 Subject: [PATCH 3/4] Allow-list minor and patch updates and document the auto-merge permissions Review feedback: an update that fetch-metadata cannot classify must not auto-merge, so the condition now requires semver-minor or semver-patch outside the calendar-versioned pm-toolchain group. The job's write scopes are documented, the dependencies group selects every package explicitly, and the item's acceptance criteria name the pm-toolchain exception. pm item: pm-slack-standup-gquv --- .agents/pm/history/pm-slack-standup-gquv.jsonl | 2 ++ .agents/pm/tasks/pm-slack-standup-gquv.toon | 7 ++++--- .github/dependabot.yml | 6 ++++-- .github/workflows/dependabot-auto-merge.yml | 11 +++++++++-- 4 files changed, 19 insertions(+), 7 deletions(-) diff --git a/.agents/pm/history/pm-slack-standup-gquv.jsonl b/.agents/pm/history/pm-slack-standup-gquv.jsonl index c1205ee..1b69a20 100644 --- a/.agents/pm/history/pm-slack-standup-gquv.jsonl +++ b/.agents/pm/history/pm-slack-standup-gquv.jsonl @@ -3,3 +3,5 @@ {"hash_algorithm":"sha256","ts":"2026-10-04T16:55:57.394Z","author":"claude-orchestrator","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"4b273145923a68729ab394ab","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"high","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.289","source":"probe"}},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T16:55:57.394Z"},{"op":"replace","path":"/metadata/status","value":"in_progress"}],"before_hash":"de13b57c9cfe8c1d681300f268484e1cb9cafd4456170f243386ce89916babc4","after_hash":"fea3a1cdb7c01f74d32196a4a5b998e59f84f5608ca1edb593b695ee16143701","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"52aac714005ebcf06e5ada1db6d558001e3f0257f2e34e36a70ab12cb25837ae"} {"hash_algorithm":"sha256","ts":"2026-10-04T16:58:39.125Z","author":"claude-orchestrator","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"4b273145923a68729ab394ab","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"high","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.289","source":"probe"}},"op":"close","patch":[{"op":"remove","path":"/metadata/assignee"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T16:58:39.125Z"},{"op":"replace","path":"/metadata/status","value":"closed"},{"op":"add","path":"/metadata/closed_at","value":"2026-10-04T16:58:38.826Z"},{"op":"add","path":"/metadata/completed_at","value":"2026-10-04T16:58:38.826Z"},{"op":"add","path":"/metadata/close_reason","value":"Rolled out the reviewed pilot (unbraind/pm-presets#118, auto-merge proven on pm-presets#119, groups made disjoint in pm-presets#120). This PR's required checks gate the merge; repository auto-merge and branch deletion enabled."}],"before_hash":"fea3a1cdb7c01f74d32196a4a5b998e59f84f5608ca1edb593b695ee16143701","after_hash":"7955867347cd8d2bc7bf4c5bc45e4b6316fef9011f6b213957cc9dcf07e8d271","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"f7eab9ff88b24066951263c4031e5d3dfb1d2f0e1ebaf39faf8127ac6e7a0b53"} {"hash_algorithm":"sha256","ts":"2026-10-04T16:58:45.597Z","author":"claude-orchestrator","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"4b273145923a68729ab394ab","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"high","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.289","source":"probe"}},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T16:58:45.597Z"}],"before_hash":"7955867347cd8d2bc7bf4c5bc45e4b6316fef9011f6b213957cc9dcf07e8d271","after_hash":"84f8c12550f45da47586f20e802f42e2c651bc293859b040318345f6c2248636","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"cb3ec96c29d9bbed020070ba44136adb7fd74cd799a587a042e2c969fb2bd9d7"} +{"hash_algorithm":"sha256","ts":"2026-10-04T17:20:35.660Z","author":"claude-orchestrator","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"4b273145923a68729ab394ab","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"high","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.289","source":"probe"}},"op":"update","patch":[{"op":"replace","path":"/metadata/acceptance_criteria","value":"dependabot.yml checks npm daily with disjoint pm-toolchain and dependencies groups; dependabot-auto-merge.yml enables squash auto-merge for the calendar-versioned pm-toolchain group (year rollovers read as semver-major) and otherwise only for updates classified minor or patch, with documented least-privilege permissions; repository allows auto-merge; required checks still gate every merge"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T17:20:35.660Z"}],"before_hash":"84f8c12550f45da47586f20e802f42e2c651bc293859b040318345f6c2248636","after_hash":"dc183df137a4b032b3367fc4a117dbc4de8b02456c5dd8742672bbdcfe98b81f","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"b9cbaa0814cb038ab67ca7438720541a4206ce5c7b2ac5d81f41fca12d5eb91b"} +{"hash_algorithm":"sha256","ts":"2026-10-04T17:20:42.041Z","author":"claude-orchestrator","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"4b273145923a68729ab394ab","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"high","source":"environment"},"role":null,"topic":null,"version":{"value":"2.1.289","source":"probe"}},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/1","value":{"created_at":"2026-10-04T17:20:42.041Z","author":"claude-orchestrator","text":"Review round 2 (Greptile/CodeRabbit across the fleet rollout): explicit minor/patch allow-list so an unclassified update never auto-merges; documented why the job needs write permissions; explicit patterns for the dependencies group; acceptance criteria now name the pm-toolchain calendar-version exception. Refused: switching to pull_request_target (GitHub keeps Dependabot-authored runs read-only there too; the pull_request + permissions pattern is proven by pm-presets#119) and removing the pm-toolchain exception (owner rule pm-cli-website-6d05: pm bumps land unattended; required checks gate them)."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T17:20:42.041Z"}],"before_hash":"dc183df137a4b032b3367fc4a117dbc4de8b02456c5dd8742672bbdcfe98b81f","after_hash":"3a1e870bd1a6ca0ff38f6b4d7b612631b3043d6f6015f93922d7e3fe5e7d49d1","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"98676392844f532ae50c04f6ddf26810b151c2b882cee26e9bb905e2fd1a5b8b"} diff --git a/.agents/pm/tasks/pm-slack-standup-gquv.toon b/.agents/pm/tasks/pm-slack-standup-gquv.toon index 47a42e6..34bb6dc 100644 --- a/.agents/pm/tasks/pm-slack-standup-gquv.toon +++ b/.agents/pm/tasks/pm-slack-standup-gquv.toon @@ -6,15 +6,16 @@ status: closed priority: 2 tags[3]: automation,ci,dependencies created_at: "2026-10-04T16:55:55.633Z" -updated_at: "2026-10-04T16:58:45.597Z" +updated_at: "2026-10-04T17:20:42.041Z" deadline: "2026-10-06T00:00:00.000Z" closed_at: "2026-10-04T16:58:38.826Z" completed_at: "2026-10-04T16:58:38.826Z" author: claude-orchestrator estimated_minutes: 15 -acceptance_criteria: dependabot.yml checks npm daily with pm-toolchain and dependencies groups; dependabot-auto-merge.yml enables squash auto-merge only for Dependabot non-major updates with least-privilege permissions; repository allows auto-merge; required checks still gate every merge -comments[1]{created_at,author,text}: +acceptance_criteria: "dependabot.yml checks npm daily with disjoint pm-toolchain and dependencies groups; dependabot-auto-merge.yml enables squash auto-merge for the calendar-versioned pm-toolchain group (year rollovers read as semver-major) and otherwise only for updates classified minor or patch, with documented least-privilege permissions; repository allows auto-merge; required checks still gate every merge" +comments[2]{created_at,author,text}: "2026-10-04T16:55:55.633Z",claude-orchestrator,Rolled out from the reviewed pilot unbraind/pm-presets#118. + "2026-10-04T17:20:42.041Z",claude-orchestrator,"Review round 2 (Greptile/CodeRabbit across the fleet rollout): explicit minor/patch allow-list so an unclassified update never auto-merges; documented why the job needs write permissions; explicit patterns for the dependencies group; acceptance criteria now name the pm-toolchain calendar-version exception. Refused: switching to pull_request_target (GitHub keeps Dependabot-authored runs read-only there too; the pull_request + permissions pattern is proven by pm-presets#119) and removing the pm-toolchain exception (owner rule pm-cli-website-6d05: pm bumps land unattended; required checks gate them)." files[2]{path,scope}: .github/dependabot.yml,project .github/workflows/dependabot-auto-merge.yml,project diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6965fa2..db63021 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -16,8 +16,10 @@ updates: - "@unbrained/pm-cli" - "pm-*" dependencies: - # Disjoint from pm-toolchain, so a pm package can never be bumped - # here (and capped by this group's update-types) instead. + # Every other npm dependency, disjoint from pm-toolchain, so a pm + # package can never be bumped here (and capped by update-types). + patterns: + - "*" exclude-patterns: - "@unbrained/pm-cli" - "pm-*" diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 12eab3b..85d4c77 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -11,6 +11,9 @@ jobs: enable-auto-merge: if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository_owner == 'unbraind' runs-on: ubuntu-latest + # `gh pr merge --auto` needs pull-requests: write to enable auto-merge + # and contents: write for the squash merge GitHub performs once the + # required checks pass. Nothing is checked out or executed from the PR. permissions: contents: write pull-requests: write @@ -18,8 +21,12 @@ jobs: - id: metadata uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 # pm-toolchain is calendar-versioned (a new year reads as semver-major), - # so it always auto-merges; any other major update waits for a person. - - if: steps.metadata.outputs.dependency-group == 'pm-toolchain' || steps.metadata.outputs.update-type != 'version-update:semver-major' + # so it always auto-merges. Anything else must be classified minor or + # patch; a major or unclassified update waits for a person. + - if: >- + steps.metadata.outputs.dependency-group == 'pm-toolchain' || + steps.metadata.outputs.update-type == 'version-update:semver-minor' || + steps.metadata.outputs.update-type == 'version-update:semver-patch' run: gh pr merge --auto --squash "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} From ccfc6afe4c42808c5c6b7c246afb4263e150830c Mon Sep 17 00:00:00 2001 From: SteveBot <1153461+unbraind@users.noreply.github.com> Date: Sun, 4 Oct 2026 20:39:02 +0200 Subject: [PATCH 4/4] Record closure evidence and the exact auto-merge allow-list on pm-slack-standup-gquv pm item: pm-slack-standup-gquv --- .agents/pm/history/pm-slack-standup-gquv.jsonl | 1 + .agents/pm/tasks/pm-slack-standup-gquv.toon | 7 +++++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.agents/pm/history/pm-slack-standup-gquv.jsonl b/.agents/pm/history/pm-slack-standup-gquv.jsonl index 1b69a20..d885504 100644 --- a/.agents/pm/history/pm-slack-standup-gquv.jsonl +++ b/.agents/pm/history/pm-slack-standup-gquv.jsonl @@ -5,3 +5,4 @@ {"hash_algorithm":"sha256","ts":"2026-10-04T16:58:45.597Z","author":"claude-orchestrator","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"4b273145923a68729ab394ab","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"high","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.289","source":"probe"}},"op":"release","patch":[{"op":"remove","path":"/metadata/claim_principal"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T16:58:45.597Z"}],"before_hash":"7955867347cd8d2bc7bf4c5bc45e4b6316fef9011f6b213957cc9dcf07e8d271","after_hash":"84f8c12550f45da47586f20e802f42e2c651bc293859b040318345f6c2248636","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"maintenance","record_hash_version":1,"record_hash":"cb3ec96c29d9bbed020070ba44136adb7fd74cd799a587a042e2c969fb2bd9d7"} {"hash_algorithm":"sha256","ts":"2026-10-04T17:20:35.660Z","author":"claude-orchestrator","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"4b273145923a68729ab394ab","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"high","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.289","source":"probe"}},"op":"update","patch":[{"op":"replace","path":"/metadata/acceptance_criteria","value":"dependabot.yml checks npm daily with disjoint pm-toolchain and dependencies groups; dependabot-auto-merge.yml enables squash auto-merge for the calendar-versioned pm-toolchain group (year rollovers read as semver-major) and otherwise only for updates classified minor or patch, with documented least-privilege permissions; repository allows auto-merge; required checks still gate every merge"},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T17:20:35.660Z"}],"before_hash":"84f8c12550f45da47586f20e802f42e2c651bc293859b040318345f6c2248636","after_hash":"dc183df137a4b032b3367fc4a117dbc4de8b02456c5dd8742672bbdcfe98b81f","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"b9cbaa0814cb038ab67ca7438720541a4206ce5c7b2ac5d81f41fca12d5eb91b"} {"hash_algorithm":"sha256","ts":"2026-10-04T17:20:42.041Z","author":"claude-orchestrator","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"4b273145923a68729ab394ab","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"high","source":"environment"},"role":null,"topic":null,"version":{"value":"2.1.289","source":"probe"}},"op":"comment_add","patch":[{"op":"add","path":"/metadata/comments/1","value":{"created_at":"2026-10-04T17:20:42.041Z","author":"claude-orchestrator","text":"Review round 2 (Greptile/CodeRabbit across the fleet rollout): explicit minor/patch allow-list so an unclassified update never auto-merges; documented why the job needs write permissions; explicit patterns for the dependencies group; acceptance criteria now name the pm-toolchain calendar-version exception. Refused: switching to pull_request_target (GitHub keeps Dependabot-authored runs read-only there too; the pull_request + permissions pattern is proven by pm-presets#119) and removing the pm-toolchain exception (owner rule pm-cli-website-6d05: pm bumps land unattended; required checks gate them)."}},{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T17:20:42.041Z"}],"before_hash":"dc183df137a4b032b3367fc4a117dbc4de8b02456c5dd8742672bbdcfe98b81f","after_hash":"3a1e870bd1a6ca0ff38f6b4d7b612631b3043d6f6015f93922d7e3fe5e7d49d1","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"98676392844f532ae50c04f6ddf26810b151c2b882cee26e9bb905e2fd1a5b8b"} +{"hash_algorithm":"sha256","ts":"2026-10-04T18:38:53.895Z","author":"claude-orchestrator","author_source":"asserted","agent_harness":"claude-code","agent_model":"claude-opus-5-5","agent_model_source":"probe","agent_instance":"4b273145923a68729ab394ab","agent_provenance":{"model":{"value":"claude-opus-5-5","source":"probe"},"effort":{"value":"high","source":"environment"},"role":{"value":"implementer","source":"argv"},"topic":null,"version":{"value":"2.1.289","source":"probe"}},"op":"update","patch":[{"op":"replace","path":"/metadata/updated_at","value":"2026-10-04T18:38:53.895Z"},{"op":"replace","path":"/metadata/description","value":"Version bumps of the pm CLI, SDK-bearing packages and fleet gates are mechanical and must land without a hand-written certification PR. Dependabot checks npm daily, groups @unbrained/pm-cli and pm-* packages into one pm-toolchain PR and every other dependency (minor/patch) into a disjoint dependencies PR; a least-privilege workflow enables GitHub squash auto-merge for the calendar-versioned pm-toolchain group and otherwise only for updates classified semver-minor or semver-patch, so a major or unclassified update waits for a person. Required checks gate every merge; a failing bump is a real defect to fix. Fleet rule: companion pm-cli-website-6d05; pilot unbraind/pm-presets#118."},{"op":"add","path":"/metadata/resolution","value":"completed"},{"op":"add","path":"/metadata/expected_result","value":"A green Dependabot pm-toolchain or minor/patch PR merges itself once required checks pass; majors and unclassified updates stay open for review."},{"op":"add","path":"/metadata/actual_result","value":"Workflow and grouped config added; the same configuration enabled squash auto-merge on a real Dependabot PR in the pilot (pm-presets#119)."}],"before_hash":"3a1e870bd1a6ca0ff38f6b4d7b612631b3043d6f6015f93922d7e3fe5e7d49d1","after_hash":"80b6041e595fe4e64cfb89cd2cb0428aa6501cf2b1a266395a5159f2e93ceaa9","item_hash_version":3,"context":{"agent_provenance_outcomes":{"model":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"},"version":{"status":"resolved","resolver":"claude_session_file","rule_version":"v1"}}},"event_class":"substantive","record_hash_version":1,"record_hash":"c54e929c168ad1bc5f0a2f528ca2447e87c5bf5270aeadb85098436b190a8921"} diff --git a/.agents/pm/tasks/pm-slack-standup-gquv.toon b/.agents/pm/tasks/pm-slack-standup-gquv.toon index 34bb6dc..9742509 100644 --- a/.agents/pm/tasks/pm-slack-standup-gquv.toon +++ b/.agents/pm/tasks/pm-slack-standup-gquv.toon @@ -1,18 +1,21 @@ id: pm-slack-standup-gquv title: Auto-merge green Dependabot updates and group the pm toolchain into one daily PR -description: "Version bumps of the pm CLI, SDK-bearing packages and fleet gates are mechanical and must land without a hand-written certification PR. Dependabot checks npm daily, groups @unbrained/pm-cli and pm-* packages into one pm-toolchain PR and other minor/patch updates into one dependencies PR; a least-privilege workflow enables GitHub squash auto-merge for every non-major Dependabot PR so it merges as soon as the required checks pass. A failing bump is a real defect to fix. Fleet rule: companion pm-cli-website-6d05; pilot unbraind/pm-presets#118." +description: "Version bumps of the pm CLI, SDK-bearing packages and fleet gates are mechanical and must land without a hand-written certification PR. Dependabot checks npm daily, groups @unbrained/pm-cli and pm-* packages into one pm-toolchain PR and every other dependency (minor/patch) into a disjoint dependencies PR; a least-privilege workflow enables GitHub squash auto-merge for the calendar-versioned pm-toolchain group and otherwise only for updates classified semver-minor or semver-patch, so a major or unclassified update waits for a person. Required checks gate every merge; a failing bump is a real defect to fix. Fleet rule: companion pm-cli-website-6d05; pilot unbraind/pm-presets#118." type: Task status: closed priority: 2 tags[3]: automation,ci,dependencies created_at: "2026-10-04T16:55:55.633Z" -updated_at: "2026-10-04T17:20:42.041Z" +updated_at: "2026-10-04T18:38:53.895Z" deadline: "2026-10-06T00:00:00.000Z" closed_at: "2026-10-04T16:58:38.826Z" completed_at: "2026-10-04T16:58:38.826Z" author: claude-orchestrator estimated_minutes: 15 acceptance_criteria: "dependabot.yml checks npm daily with disjoint pm-toolchain and dependencies groups; dependabot-auto-merge.yml enables squash auto-merge for the calendar-versioned pm-toolchain group (year rollovers read as semver-major) and otherwise only for updates classified minor or patch, with documented least-privilege permissions; repository allows auto-merge; required checks still gate every merge" +resolution: completed +expected_result: A green Dependabot pm-toolchain or minor/patch PR merges itself once required checks pass; majors and unclassified updates stay open for review. +actual_result: Workflow and grouped config added; the same configuration enabled squash auto-merge on a real Dependabot PR in the pilot (pm-presets#119). comments[2]{created_at,author,text}: "2026-10-04T16:55:55.633Z",claude-orchestrator,Rolled out from the reviewed pilot unbraind/pm-presets#118. "2026-10-04T17:20:42.041Z",claude-orchestrator,"Review round 2 (Greptile/CodeRabbit across the fleet rollout): explicit minor/patch allow-list so an unclassified update never auto-merges; documented why the job needs write permissions; explicit patterns for the dependencies group; acceptance criteria now name the pm-toolchain calendar-version exception. Refused: switching to pull_request_target (GitHub keeps Dependabot-authored runs read-only there too; the pull_request + permissions pattern is proven by pm-presets#119) and removing the pm-toolchain exception (owner rule pm-cli-website-6d05: pm bumps land unattended; required checks gate them)."