Repository navigation
Compliance: ruleset-bypass-dependabot-code-quality #482
Description
Compliance Finding
Category: rulesets
Severity: error
Check: ruleset-bypass-dependabot-code-quality
Detail
Ruleset code-quality (targets main) is missing the required dependabot-automerge-petry app (id 3167543) bypass actor (bypass_mode: always). Without it, Dependabot auto-merge API calls are rejected by this ruleset — GitHub evaluates bypass per-ruleset, so it must be present on every ruleset targeting the default branch, not only pr-quality.
Standard Reference
standards/github-settings.md#bypass-actors--required-on-every-ruleset-targeting-main
Remediation
Please review the linked standard and bring this repository into compliance.
See the full standards documentation for implementation guidance.
This issue was automatically created by the weekly compliance audit.
Activity
don-petry commentedon Sep 18, 2026
Weekly Compliance Audit (2026-09-18)
This finding is still open.
Detail: Ruleset
code-quality(targetsmain) is missing the requireddependabot-automerge-petryapp (id 3167543) bypass actor (bypass_mode: always). Without it, Dependabot auto-merge API calls are rejected by this ruleset — GitHub evaluates bypass per-ruleset, so it must be present on every ruleset targeting the default branch, not onlypr-quality.Standard: standards/github-settings.md#bypass-actors--required-on-every-ruleset-targeting-main
don-petry commentedon Sep 25, 2026
Weekly Compliance Audit (2026-09-25)
This finding is still open.
Detail: Ruleset
code-quality(targetsmain) is missing the requireddependabot-automerge-petryapp (id 3167543) bypass actor (bypass_mode: always). Without it, Dependabot auto-merge API calls are rejected by this ruleset — GitHub evaluates bypass per-ruleset, so it must be present on every ruleset targeting the default branch, not onlypr-quality.Standard: standards/github-settings.md#bypass-actors--required-on-every-ruleset-targeting-main
don-petry commentedon Sep 25, 2026
dev-lead is withholding action on this item.
It is labeled
dev-lead:hands-off(deliberately kept off-limits to dev-lead (e.g. changes to the dev-lead automation itself)), so dev-lead will not pick it up while that label is present. This notice is posted once so the withhold is visible rather than looking like a stalled run.To re-enable automated pickup: remove the
dev-lead:hands-offlabel.don-petry commentedon Oct 2, 2026
Weekly Compliance Audit (2026-10-02)
This finding is still open.
Detail: Ruleset
code-quality(targetsmain) is missing the requireddependabot-automerge-petryapp (id 3167543) bypass actor (bypass_mode: always). Without it, Dependabot auto-merge API calls are rejected by this ruleset — GitHub evaluates bypass per-ruleset, so it must be present on every ruleset targeting the default branch, not onlypr-quality.Standard: standards/github-settings.md#bypass-actors--required-on-every-ruleset-targeting-main
don-petry commentedon Oct 9, 2026
Weekly Compliance Audit (2026-10-09)
This finding is still open.
Detail: Ruleset
code-quality(targetsmain) is missing the requireddependabot-automerge-petryapp (id 3167543) bypass actor (bypass_mode: always). Without it, Dependabot auto-merge API calls are rejected by this ruleset — GitHub evaluates bypass per-ruleset, so it must be present on every ruleset targeting the default branch, not onlypr-quality.Standard: standards/github-settings.md#bypass-actors--required-on-every-ruleset-targeting-main
don-petry commentedon Oct 16, 2026
Weekly Compliance Audit (2026-10-16)
This finding is still open.
Detail: Ruleset
code-quality(targetsmain) is missing the requireddependabot-automerge-petryapp (id 3167543) bypass actor (bypass_mode: always). Without it, Dependabot auto-merge API calls are rejected by this ruleset — GitHub evaluates bypass per-ruleset, so it must be present on every ruleset targeting the default branch, not onlypr-quality.Standard: standards/github-settings.md#bypass-actors--required-on-every-ruleset-targeting-main