fix(ci): enable allow_auto_merge and convert dependabot-automerge to thin-caller stub

[don-petry]

Summary

• Enabled the allow_auto_merge repository setting via GitHub API (null → true), resolving the weekly compliance audit finding
• Converted .github/workflows/dependabot-automerge.yml from an inline workflow to the standard thin-caller stub that delegates to dependabot-automerge-reusable.yml@v1

Why both changes

The compliance audit (scripts/compliance-audit.sh) checks allow_auto_merge via the GitHub API and was seeing null. The setting has now been applied directly.

The inline dependabot-automerge.yml was pre-centralization code that:

• Was missing skip-commit-verification: true (present in the reusable since a later update)
• Was missing the "Check app secrets" step (present in the reusable)
• Duplicated eligibility logic already maintained in dependabot-automerge-reusable.yml

The thin-caller stub is the org standard per standards/workflows/dependabot-automerge.yml and delegates all logic to the reusable.

Test plan

• allow_auto_merge verified true via gh api repos/petry-projects/.github --jq '.allow_auto_merge'
• Stub calls dependabot-automerge-reusable.yml@v1 which has full eligibility logic, skip-commit-verification: true, and app secrets check
• Next weekly compliance audit should close issue Compliance: allow_auto_merge #107 automatically (no longer finds null)
• Next Dependabot PR to this repo will exercise the reusable path

Closes #107

Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@github-actions[bot] has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 59 minutes and 59 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9e23848e-0b71-4ee3-bf82-eefa89e075d2

📥 Commits

Reviewing files that changed from the base of the PR and between fc73ff1 and 1e1a099.

📒 Files selected for processing (1)

• .github/workflows/dependabot-automerge.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-107-20260508-1732

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
2 Security Hotspots

See analysis details on SonarQube Cloud

[don-petry]

Self-Review

The changes look correct. One item needs human attention:

SonarCloud Security Hotspots

SonarCloud flagged 2 security hotspots related to the pull_request_target trigger combined with secrets: inherit. These are expected patterns for this type of workflow and are safe here because the reusable workflow never checks out untrusted pull request code — it only runs gh pr review and gh pr merge commands using an authenticated App token.

These hotspots appear because this file uses the verbatim org standard template from standards/workflows/dependabot-automerge.yml, which mandates both pull_request_target and secrets: inherit. Every repo that adopts this standard will have the same hotspots.

The SonarCloud Code Analysis check is not a required status check for this repo (code-quality ruleset is not yet configured for .github), so this does not block the merge.

Action needed: Please acknowledge/dismiss these hotspots as "Safe" in the SonarCloud dashboard after reviewing.

---

@petry-projects/org-leads — please review and merge when ready.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.