From c378c66a9e9586ded240d15ee489d76e8b8b5545 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sat, 1 Aug 2026 10:32:44 -0700 Subject: [PATCH] Declare the merge-bot workflow the release contract already grades spec/files.json required .github/dependabot.yml on every repo and never required the workflow that merges the pull requests it opens. A grep for merge-bot across the whole baseline returned nothing, while WORKFLOW.md D8.1 grades its behavior, GOVERNANCE.md links it twice as an in-repo path, and audit reports already mark a repo drifting for not having one. So a graded behavioral contract had no corresponding required file, and a repo could carry valid App credentials that nothing consumes. Blog hit it as designed: 23 of 23 applicable baseline files present, configure.sh check exit 0, and then Dependabot opened its first pull request with nowhere to go. The gap is invisible to a presence audit because the missing file is not in the list being checked. Declared at interface fidelity, since a repo legitimately prunes jobs for bots it does not have. The required keys are the two that are universal: merge-dependabot, because dependabot.yml applies to every repo, and disable-auto-merge-on-maintainer-push, which D8.1 names directly. merge-codegen and merge-upstream-version stay optional. Reported by the Blog agent on #456, and confirmed against the fleet: 15 of 21 repos already carry the file, so this ratifies the de facto standard rather than inventing one. Co-Authored-By: Claude Opus 5 (1M context) --- spec/files.json | 1 + 1 file changed, 1 insertion(+) diff --git a/spec/files.json b/spec/files.json index 241549ac..d261391c 100644 --- a/spec/files.json +++ b/spec/files.json @@ -27,6 +27,7 @@ { "path": "spec/secrets.json", "fidelity": "intent", "intentRef": "docs/repo-config-carry.md", "appliesTo": "*" }, { "path": ".github/dependabot.yml", "appliesTo": "*" }, { "path": ".github/workflows/test-pull-request.yml", "fidelity": "interface", "contract": { "requiredJobKeys": ["check-workflow-status"], "requiredCheckName": "Check pull request workflow status job" }, "intentRef": "GOVERNANCE.md#workflow-yaml-conventions", "appliesTo": "*" }, + { "path": ".github/workflows/merge-bot-pull-request.yml", "fidelity": "interface", "contract": { "requiredJobKeys": ["merge-dependabot", "disable-auto-merge-on-maintainer-push"] }, "intentRef": "WORKFLOW.md#d8---bots--automation", "appliesTo": "*" }, { "path": ".github/workflows/build-release-task.yml", "fidelity": "interface", "contract": { "requiredJobKeys": ["get-version", "validate-release", "github-release"], "artifactNameToken": "release-asset-", "requireTokensInJob": { "github-release": ["pattern:", "merge-multiple:"] }, "forbidTokensInJob": { "github-release": ["artifact-ids:"] }, "verbatimJobs": ["github-release"] }, "reference": "catalog/snippets/workflows/build-release-task.yml", "intentRef": "GOVERNANCE.md#release-model", "appliesTo": ["csharp", "console", "docker", "nuget", "pypi", "eda"] }, { "path": ".vscode/tasks.json", "sections": ["clean-compile task group"], "reference": "catalog/snippets/configs/vscode-tasks.json", "appliesTo": ["csharp"] }, { "path": ".vscode/tasks.json", "sections": ["clean-compile task group"], "reference": "catalog/snippets/configs/vscode-tasks-python.json", "appliesTo": ["python"] },