docs+ci: estate dependabot policy — ignore semver-major by default (closes #297)

[hyperpolymath]

Summary

Documents the estate's policy on major-version dependabot bumps, derived from the 2026-05-29 echidna incident where five major bumps auto-merged green through validation gates that don't compile the workspace, then broke compile on every subsequent push for ~24h.

Policy summary

1. Each repo's .github/dependabot.yml MUST ignore version-update:semver-major for each ecosystem.
2. Branch protection MUST require the compile / test gate (Rust CI, etc.) — closes the gap between "validated" and "compiles."
3. --locked (or the ecosystem equivalent) on every CI cargo / npm / deno invocation — already landed in standards#299.

Changes

• docs/DEPENDABOT-POLICY.adoc (new) — full policy document with rationale, recommended template, and migration plan.
• .github/dependabot.yml — self-demonstrates the policy shape for the github-actions ecosystem (no semver-major ignore needed for github-actions because SHA pins are the real version; comment explains the carve-out).

What this does NOT do

• Does not fan out the ignore-semver-major stanza to all ~140 estate repos — that's a separate campaign issue (TODO file once this lands).
• Does not block security-advisory-driven dependabot PRs (those flow via the security-updates path which is intentionally not gated by this policy).
• Does not change feedback_always_automerge_prs — the auto-merge hook is fine for minor/patch PRs that pass the compile gate (recommendation Welcome to standards Discussions! #2 above ensures the compile gate is required).

Cross-refs

• echidna#92 + echidna#128 — the real-world incident.
• standards#299 — --locked in rust-ci-reusable (complementary fix, already merged).
• standards#294 / standards#298 — --no-lock for the file walker (orthogonal).
• standards#296 / standards#300 — trusted-base 5-line window (orthogonal).

Closes #297.
EOF
)

[github-actions]

🔍 Hypatia Security Scan

Findings: 183 issues detected

Severity	Count
🔴 Critical	65
🟠 High	30
🟡 Medium	88

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affinescript-verify.yml",
    "type": "unknown",
    "file": "affinescript-verify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in boj-build.yml",
    "type": "unknown",
    "file": "boj-build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "unknown",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "unknown",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in changelog-reusable.yml",
    "type": "unknown",
    "file": "changelog-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql-reusable.yml",
    "type": "unknown",
    "file": "codeql-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in codeql.yml",
    "type": "unknown",
    "file": "codeql.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in deno-ci-reusable.yml",
    "type": "unknown",
    "file": "deno-ci-reusable.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in doc-format.yml",
    "type": "unknown",
    "file": "doc-format.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence