feat(selector): route same-repository Dependabot runs to the fleet

[kyle-sexton]

Why

Dependabot-triggered CI is the dominant remaining hosted spend (est. 1,500–3,000 min/mo) and draws down the 3,000 included-minute reserve the org keeps for must-be-hosted jobs and fleet-down fallback. The org owner explicitly approved retiring the selector's "Dependabot must never receive the observer credential" guard (named approval, this session) so same-repo bump PRs route to the ephemeral one-job fleet like any push.

What

• select-runner.cjs: drop the isDependabot hosted-only preflight term + the input; rationale comment updated (fork/public guards untouched)
• select-runner.yml: token-mint step no longer excludes dependabot[bot] / secret_source == 'Dependabot'; IS_DEPENDABOT env removed; embedded bundle regenerated (render-select-runner-workflow.cjs --check passes)
• select-runner.test.cjs: Dependabot hosted-route cases and static-guard terms removed (98/98 pass)
• README: selector routing + zizmor eligibility wording updated; documents the Dependabot-store mirror requirement

Security boundary after this change

• Fork PRs and public repos: hosted-only, unchanged
• Observer key: still confined to the selector job (lanes receive a label string only); on Dependabot events it resolves from the org Dependabot secrets store — until CI_RUNNER_OBSERVER_PRIVATE_KEY is mirrored there, Dependabot runs simply fall back hosted (missing-secret), so rollout is fail-safe
• Dependency-bump code executes in ephemeral one-job Docker workers, no docker socket, resource-capped

Activation

Org owner mirrors the observer key: gh secret set CI_RUNNER_OBSERVER_PRIVATE_KEY --org melodic-software --app dependabot --visibility selected --repos "claude-code-plugins,dotfiles,github-iac,medley,provisioning,standards" < <observer-key.pem>

Follow-up

A dependabot-routing case in local-runner-canary would give this a proof-harness; none existed for the old behavior either.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JLfjHY8PY6ozhgZPiuHKik

[claude]

Claude finished @kyle-sexton's task in 1m 55s —— View job

---

PR Review

• Gather context
• Read changed files
• Analyze security implications
• Post review findings

---

Summary

This PR removes the isDependabot hosted-only guard from the runner selector so that same-repository Dependabot PRs route to the ephemeral fleet like any other private same-repo pull_request. The change is logically correct, the embedded bundle stays in sync with the standalone script, and the fail-safe activation model (fall back to missing-secret/hosted until the org mirrors the key to the Dependabot secrets store) is sound.

A few items worth discussing:

---

Defense-in-depth: secret_source guard removed from token-mint if

File: .github/workflows/select-runner.yml L83–99

The previous if condition included two explicit Dependabot exclusions:

github.actor != 'dependabot[bot]'
github.secret_source != 'Dependabot'

Both are removed. The intent is correct—same-repo Dependabot runs should now be eligible to mint the observer token (once the key is mirrored to the Dependabot store). However, secret_source == 'Dependabot' is set by GitHub on any event where Dependabot is the triggering actor, including push events from Dependabot branches. In practice this is fine today because:

• push from Dependabot branches only occurs for same-repo bumps (private repo, repositoryPrivate == true)
• The if condition still requires github.event.repository.private == true
• No mechanism currently gives Dependabot schedule or workflow_dispatch a different secret_source

So no actionable risk here, but it's worth a conscious acknowledgement that the secret_source check was the last context-level signal distinguishing "Dependabot secrets in scope" from "Actions secrets in scope." Its removal is a deliberate architectural choice, not an oversight.

---

Static guard test alignment

File: .github/scripts/select-runner.test.cjs L931–941

The test that validates required guards on the token-mint step correctly drops the two Dependabot assertions. The remaining verified guards (private == true, fork-PR repo match, event allowlist) are still present in the workflow and covered. No issue — just confirming the test update is in lockstep with the if condition change.

---

No new positive Dependabot routing test (acknowledged gap)

Since isDependabot is no longer an input field, a same-repo Dependabot pull_request is now indistinguishable from any other same-repo PR at the selector layer. That means the existing pull_request + isForkPullRequest: false tests implicitly cover the new Dependabot path — no new unit test is strictly needed for correctness. The PR body calls out a canary-level proof-harness as a follow-up, which is the right place for it.

---

Bundle / script consistency: confirmed

The embedded bundle in select-runner.yml L685–689 matches the standalone select-runner.cjs L547–550: isDependabot / IS_DEPENDABOT removed from both.

---

Minor: README link semantics shift

File: README.md L177–184

The [dependabot-secrets] link was previously used to justify why Dependabot routes hosted. It now anchors the requirement to mirror the key to the Dependabot store. The shift is correct in context, but if the link target is a GitHub doc on the Dependabot secret boundary (rather than the secrets store API), a reader following the link expecting setup guidance may need to look further. Low impact, fine as-is.

---

Verdict

Approved from a correctness and security standpoint. The fork-PR and public-repo guards are untouched. The observer key is still confined to the selector job; lanes only receive a label string. The fail-safe rollout path (missing-secret → hosted until the org mirrors the key) is correctly implemented. No blocking issues.