fix(ci): only bypass admin review for dependabot patch/minor

[EricAndrechek]

Summary

Closes #130 (the title-length and admin-bypass halves; the go-mod-tidy half is intentionally deferred — manual make tidy && go mod tidy after a failing CI run is the accepted workflow).

admin-approval.yml previously short-circuited to success for all Dependabot PRs, on the assumption that "no bot approves itself + no auto-merge enabled = major bumps will sit." That assumption broke once CodeRabbit started auto-approving Dependabot PRs after autofixes. PR #127 (major-bump: TypeScript 5→6, Astro 5→6, etc.) reached mergeStateStatus: CLEAN, reviewDecision: APPROVED — one click from main — with no admin review:

• CodeRabbit's APPROVED review satisfied the ruleset's required_approving_review_count: 1
• The unconditional bypass posted Admin approval: success
• CI was green

Changes

admin-approval.yml

• New Fetch Dependabot metadata step at the top, gated on Dependabot author (continue-on-error: true so a metadata fetch failure on a Dependabot PR fail-safes to "no bypass" rather than erroring the workflow).
• Bypass logic now only fires when update-type is version-update:semver-patch or version-update:semver-minor. Majors, unknown types, and empty UPDATE_TYPE (metadata fetch failed) fall through to the same admin-review evaluation as human PRs.
• Updated header comment + inline comments to explain the new model and reference bug: dependabot PRs don't always pass CI #130 / docs: bump the docs-deps group across 1 directory with 4 updates #127 as the trigger.

housekeeping.yml

• PR title length check (72-char cap) now exempts Dependabot. Format regex is still enforced; Dependabot's grouped-update titles already use lowercase deps: / ci: / docs: prefixes, so they pass naturally. Fixes the half of bug: dependabot PRs don't always pass CI #130 about title-length blocking grouped bumps (e.g., deps: bump github.com/nats-io/nats.go from 1.51.0 to 1.52.0 in the go-deps group #128's 80-char title).

AGENTS.md

• Three passages updated to reflect "Dependabot patch/minor PRs bypass; majors require admin review same as human PRs."
• New note in the Dependabot section explaining that required_approving_review_count: 0 in the ruleset is intentional — the Admin approval status check is the single admin-review gate, so any bot's APPROVED review is no longer load-bearing.

Ruleset change (manual, after merge)

The workflow changes alone close the security hole (majors now post Admin approval: pending, blocking merge). The ruleset count-rule change is defense-in-depth — without it, CodeRabbit's approval can still satisfy count: 1 on a major bump even though the Admin approval status is now correctly pending.

Easiest path is the GitHub UI: Settings → Rules → main branch protection (ruleset 15353356) → Require a pull request before merging → set "Required approving reviews" to 0. All other rule params should stay unchanged — especially dismiss_stale_reviews_on_push: true, strict_required_status_checks_policy: true, the required status checks list, and the admin bypass actor.

(gh api works too but requires fetching the current ruleset, modifying the required_approving_review_count field inside the pull_request rule, and PUT-ing the full payload back. The UI is one click.)

Behavior matrix after this PR (workflow only, before ruleset change)

PR type	Title cap	Admin approval status	Count rule	Merges?
Dependabot patch	exempt	success (bypassed)	bot self-approval	yes, auto
Dependabot minor	exempt	success (bypassed)	bot self-approval	yes, auto
Dependabot major (no admin)	exempt	pending	CodeRabbit may satisfy	blocked by status
Dependabot major (admin approved)	exempt	success	yes	yes, manual
Human PR (no admin)	72-char	pending	—	blocked
Human PR (admin approved)	72-char	success	yes	yes, manual

After the ruleset change (count → 0), the third row stays blocked regardless of CodeRabbit's approval state, closing the defense-in-depth gap.

Test plan

• Once merged, next Monday's Dependabot patch/minor bumps auto-merge as before (no regression on the auto-merge path).
• Open a draft test PR with an 80-char title to verify the title-cap exemption only applies to Dependabot (i.e., human long-title still fails).
• On the next major-version Dependabot PR: confirm Admin approval status posts pending and the PR is blocked until an admin approves.
• Apply ruleset change (count: 0) and verify the same major PR remains blocked even if CodeRabbit's review is APPROVED.

Notes

• I considered also touching housekeeping.yml's reviewer-assign skip-for-Dependabot logic, but it's still correct: dependabot-automerge.yml already assigns both admins on majors, so housekeeping's skip avoids a double-request. Left as-is.
• The CodeRabbit dashboard switch (from APPROVED to COMMENTED) is intentionally NOT part of this PR — it's a separate dashboard setting, not a repo change.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Refined automated dependency update workflows with improved approval handling for different update types.
  • Enhanced pull request validation to better support automated dependency changes while maintaining code quality standards.
  • Updated development governance documentation with clearer guidelines and more explicit rules for approval processes and automation.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request refines the CI automation logic to close a security gap where major Dependabot version bumps could be merged without human admin review due to bot-generated approvals. It introduces granular bypass logic for the admin-approval workflow and relaxes title length constraints for automated dependency updates, while maintaining strict standards for human-authored pull requests.

Highlights

• Dependabot Admin Bypass Logic: Updated the admin-approval workflow to only bypass admin review for Dependabot patch and minor updates, ensuring major version bumps require explicit admin approval.
• Title Length Enforcement: Exempted Dependabot PRs from the 72-character title length limit in the housekeeping workflow to prevent blocking grouped dependency updates.
• Documentation Updates: Updated AGENTS.md to reflect the new security model for Dependabot PRs and clarify the role of the admin-approval status check.

Ignored Files

• Ignored by pattern: .github/workflows/** (2)
  • .github/workflows/admin-approval.yml
  • .github/workflows/housekeeping.yml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR refines Dependabot CI and merge gate behavior: the admin-approval workflow now conditionally bypasses only for patch/minor updates (via metadata fetch and UPDATE_TYPE check), housekeeping exempts Dependabot from title length limits while preserving format validation, and AGENTS.md documents the new governance rules.

Changes

Dependabot-aware CI and merge gates

Layer / File(s)	Summary
Admin-approval conditional bypass for patch/minor .github/workflows/admin-approval.yml	Workflow now fetches Dependabot update metadata, derives UPDATE_TYPE, and only bypasses the admin-review gate for patch/minor updates; major updates and fetch failures post pending status and fall through to normal admin evaluation. Inline documentation updated to reflect conditional bypass behavior.
Housekeeping title validation for Dependabot .github/workflows/housekeeping.yml	PR author is captured and used to detect Dependabot. Title validation now conditionally enforces the 72-character max-length only for non-Dependabot authors while still validating Conventional Commits format for all authors.
Governance documentation updates AGENTS.md	Admin-review gate description, Dependabot automation rules, and Governance Files section are clarified: patch/minor PRs bypass via dependabot-automerge.yml, major bumps require explicit admin approval via admin-approval.yml, and enforcement is workflow-driven rather than CODEOWNERS-based.

🐰 The bots now know their place, with rules that are tight,
Patch-and-minor speeds through, but major needs sight,
No more title-length tyranny for our auto-friends,
Governance workflows ensure that the merge queue transcends!
hops around celebrating cleaner CI gates 🎉

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: restricting Dependabot PR admin-approval bypass to patch/minor updates only.
Linked Issues check	✅ Passed	The PR addresses the core coding requirement from issue #130 to exempt Dependabot from the PR title length check; defers the go mod tidy automation as noted.
Out of Scope Changes check	✅ Passed	All changes are scoped to the stated objectives: CI workflow modifications, Dependabot handling, title validation exemption, and documentation updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot-130

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@AGENTS.md`:
- Around line 344-349: Add an [Unreleased] CHANGELOG.md entry describing the
governance/workflow change: note that
`.github/workflows/dependabot-automerge.yml` now auto-approves and auto-merges
Dependabot patch/minor bumps (bypassing the `Admin approval` status check),
while major bumps require human admin approval (per `admin-approval.yml`) and
are not auto-bypassed; include that the ruleset's
`required_approving_review_count` remains 0 and that the Admin approval status
check is the single admin-review gate, and place this under the "Changed"
subsection of the [Unreleased] section.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 42e50e2c-421c-4a1e-9ccb-b3042ff72425

📥 Commits

Reviewing files that changed from the base of the PR and between b8fc829 and 2ec2eff.

📒 Files selected for processing (3)

• .github/workflows/admin-approval.yml
• .github/workflows/housekeeping.yml
• AGENTS.md

[claude]

1 [MUST], 0 [SHOULD], 0 [MAY] — see inline thread for detail.

The workflow logic is correct: the dependabot/fetch-metadata step is properly SHA-pinned, continue-on-error: true gives the right fail-safe (empty UPDATE_TYPE → admin review, not auto-bypass), the patch/minor string comparisons are exact and safe, and the housekeeping title-length exemption is cleanly scoped to Dependabot without loosening the format regex. AGENTS.md is fully updated to match the new security model.

One gap: CHANGELOG.md has no entry for a change that the PR body itself describes as closing a security hole. AGENTS.md's doc-sync rules make this a hard [MUST] — see inline thread.

Iterate — add a CHANGELOG.md [Unreleased] / Fixed entry describing the admin-approval bypass fix.

@EricAndrechek

[gemini-code-assist]

Code Review

This pull request updates AGENTS.md to document refined governance procedures for Dependabot, specifically closing a security gap by requiring manual admin approval for major version updates while maintaining auto-merge for patch and minor bumps. It also explains the repository's reliance on a custom status check over the native review count rule and notes a title-length exemption for Dependabot. Feedback from the review includes a requirement to document these notable changes in the CHANGELOG.md as per the style guide and a suggestion to clarify which workflow file implements the approval bypass logic for better documentation consistency.