Repository navigation
Compliance: ruleset-bypass-dependabot-main #131
Description
Compliance Finding
Category: rulesets
Severity: error
Check: ruleset-bypass-dependabot-main
Detail
Ruleset main (targets main) is missing the required dependabot-automerge-petry app (id 3167543) bypass actor (bypass_mode: always). Without it, Dependabot auto-merge API calls are rejected by this ruleset — GitHub evaluates bypass per-ruleset, so it must be present on every ruleset targeting the default branch, not only pr-quality.
Standard Reference
standards/github-settings.md#bypass-actors--required-on-every-ruleset-targeting-main
Remediation
Please review the linked standard and bring this repository into compliance.
See the full standards documentation for implementation guidance.
This issue was automatically created by the weekly compliance audit.
Activity
don-petry commentedon Oct 19, 2026
Closed on the Maintainer's decision of 2026-10-19 (plan review, decision 4). This repo departs from the org's workflow and ruleset standards where
docs/decisions/0014-where-this-repo-departs-from-the-orgs-standards.mdsays why: one required check, no proof-of-concept workflows, no bypass actor onmain, and rulesets the design (§4.9, #62) sets itself. This report asks for something that decision declines or that the design forbids, so it serves no requirement here. The standards repo is asked to exclude combsmith/software-factory from the audit; if it cannot, the next report is labelled hands-off and left.