[skip-logmind] chore: add dependabot auto-merge caller workflow (§8.1)

[thrillmot]

Summary

• Adds a tiny caller workflow that delegates Dependabot patch + minor auto-merge to the reusable workflow at thrillmade/.github.
• Major bumps are still surfaced for human review.

Why

Path A from org master plan §8.1 — near-term unblock for org-wide dependency hygiene. Without this, Dependabot PRs accumulate (CI churn, security tail) until a human babysits each one.

Depends on

thrillmade/.github#1 (the reusable workflow itself). This PR can land first or after — the workflow is dormant until the reusable target exists at main.

Test plan

• Land thrillmade/.github#1 first.
• Land this PR.
• Watch the next Dependabot patch/minor PR get auto-approved and merged.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
logmind-site	Ignored	Preview	Jun 4, 2026 3:34pm

[claude]

Claude finished @thrillmot's task in 2m 6s —— View job

---

Review tasks

• Load tool schemas
• Fetch PR diff
• Check skills and strict-mode config
• Read existing workflow conventions
• Analyze for critical issues
• Post inline comment
• Emit structured summary

1 critical finding — see inline thread on line 19.

[github-actions]

🐛 Clud Bug review

This round: 1 critical · 0 minor · 0 resolved from prior · 0 still open

Found: 1 🔴 / 0 🟡 / 0 🟣

Per-skill scan

• [critical-issues-only]: scanned 1 file. 1 critical finding below.
• [evidence-based-review]: applied to all findings. Finding anchored to line 19 with quoted code.
• [respect-existing-conventions]: convention mismatch detected — all other workflow uses: pins use immutable refs; this PR uses @main.

Critical findings

🔴 [critical-issues-only]: Mutable @main pin passes all repo secrets to external reusable workflow on pull_request_target trigger (.github/workflows/dependabot-auto-merge.yml:19).

Reasoning

uses: thrillmade/.github/...@main with secrets: inherit on a pull_request_target (write-privileged) trigger. Every other workflow in this repo pins to an immutable ref (@v6, @v1.0.133, etc.). Any unreviewed push to thrillmade/.github@main is immediately picked up with write access and full secrets. Fix: pin to a commit SHA and update via PRs.

Skills referenced: [critical-issues-only, evidence-based-review, respect-existing-conventions]

[claude]

Claude finished @thrillmot's task in 1m 42s —— View job

---

Review tasks

• Load tool schemas
• Check incremental-diff handshake (prior SHA)
• Walk prior review threads (FIX-PUSH FLOW)
• Fetch diff and read workflow file
• Analyze for critical issues
• Emit structured summary

This synchronize push was a merge-from-main commit (9c73ab6) — no changes to the workflow file itself. The prior critical finding on line 19 (uses: …@main with secrets: inherit on pull_request_target) is still open. See the existing inline thread for the fix.

[github-actions]

🐛 Clud Bug review

This round: 0 critical · 0 minor · 0 resolved from prior · 1 still open

Found: 0 🔴 / 0 🟡 / 0 🟣

Per-skill scan

• [critical-issues-only]: scanned 1 file. 0 new findings; 1 prior finding still open (line 19 @main pin).
• [evidence-based-review]: 0 new findings. Prior finding anchored to line 19 — still unaddressed.
• [respect-existing-conventions]: 0 new findings. Prior convention mismatch (mutable ref vs. repo's immutable pin pattern) still open.

Skills referenced: [critical-issues-only, evidence-based-review, respect-existing-conventions]

[claude]

Claude finished @thrillmot's task in 1m 11s —— View job

---

Review tasks

• Load tool schemas
• Check incremental-diff handshake (prior SHA: 9c73ab6)
• Walk prior review threads (FIX-PUSH FLOW)
• Fetch delta diff and verify fix
• Resolve fixed threads / flag still-open issues
• Emit structured summary

Prior critical finding addressed: @main pinned to full commit SHA e4dfd7ea66a4.... Prior inline thread already marked resolved. No new issues found.

[github-actions]

🐛 Clud Bug review

This round: 0 critical · 0 minor · 1 resolved from prior · 0 still open

Found: 0 🔴 / 0 🟡 / 0 🟣

Per-skill scan

• [critical-issues-only]: scanned 1 file. 0 new findings; prior critical (line 19 @main pin) resolved.
• [evidence-based-review]: 0 findings. Prior finding at line 19 now fixed with full commit SHA.
• [respect-existing-conventions]: 0 findings. Repo convention of immutable refs now honored on line 20.

Skills referenced: [critical-issues-only, evidence-based-review, respect-existing-conventions]