From 23f85a68af2e764485981d4948a80256db6784a4 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Fri, 8 May 2026 14:20:27 +0000 Subject: [PATCH] fix(ci): sync dependabot-rebase.yml with canonical org stub Replace outdated workflow stub with canonical version from petry-projects/.github/standards/workflows/dependabot-rebase.yml. Changes: - Add missing schedule trigger (every 4 hours) as safety net when no pushes to main occur to keep Dependabot PR queue flushed - Update AGENTS comment to document the schedule trigger - Update APP_ID comment to include contents:write permission Closes #132 Co-authored-by: Don Petry --- .github/workflows/dependabot-rebase.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/dependabot-rebase.yml b/.github/workflows/dependabot-rebase.yml index ade5fa9..fe0671e 100644 --- a/.github/workflows/dependabot-rebase.yml +++ b/.github/workflows/dependabot-rebase.yml @@ -11,8 +11,9 @@ # • You MUST NOT change: the concurrency group name, the explicit secrets # block, or the job-level `permissions:` block — reusable workflows can be # granted no more permissions than the calling job has, so removing the -# stanza breaks the reusable's gh API calls. Do not remove either trigger -# (`push` keeps the self-sustaining chain; `workflow_dispatch` allows +# stanza breaks the reusable's gh API calls. Do not remove any trigger +# (`push` keeps the self-sustaining chain; `schedule` is the safety net +# when no PR merges have occurred recently; `workflow_dispatch` allows # manual queue flushes). # • If you need different behaviour, open a PR against the reusable in the # central repo. @@ -21,7 +22,7 @@ # Dependabot update-and-merge — thin caller for the org-level reusable. # To adopt: copy this file to .github/workflows/dependabot-rebase.yml in your repo. # Required org secrets (passed explicitly): -# APP_ID — GitHub App ID with pull-requests:write +# APP_ID — GitHub App ID with contents:write and pull-requests:write # APP_PRIVATE_KEY — GitHub App private key name: Dependabot update and merge @@ -29,6 +30,8 @@ on: push: branches: - main + schedule: + - cron: '0 */4 * * *' # every 4 hours — safety net when no pushes to main trigger the chain workflow_dispatch: # allow manual trigger to flush Dependabot PR queue concurrency: