Major bump path doesn't fail-safe when `DEP_NAMES` is empty but omits the empty-check guard path

[smartwatermelon]

Non-Blocking Review Concern: Major bump path doesn't fail-safe when DEP_NAMES is empty but omits the empty-check guard path

Source: pre-push whole-codebase review
Location: .github/workflows/dependabot-auto-merge.yml:68
Date: 2026-08-03

What was flagged

When DEP_NAMES is empty and prev_major != new_major, the code correctly detects this and skips. However, if DEP_NAMES contains only whitespace or commas (e.g., "," or " , "), the grep -v '^$' filter removes those entries, leaving remainder empty — which would then evaluate as a trusted-namespace match and proceed to merge a major bump with no verifiable dependency names. This is an edge case in fetch-metadata output, unlikely but worth noting. The [ -z "${DEP_NAMES:-}" ] guard only catches the completely-empty case. This is pre-existing in the current file (not introduced by this diff).

Context

This issue was automatically created from a non-blocking concern identified
during pre-push whole-codebase review. It was flagged for tracking.

---

Created by lib-review-issues.sh