Automate bot PR maintenance end-to-end

[tpvasconcelos]

Automates the recurring dependabot / pre-commit.ci PR chores so that the only human action left is a quick review + approval.

How it works

1. .github/dependabot.yml: switch from daily per-dependency PRs to a single weekly grouped PR per ecosystem (less noise, fewer overlapping bot PRs).
2. .github/workflows/bot-prs.yml (new): for PRs authored by dependabot[bot] or pre-commit-ci[bot]:
   • Commits a changelog entry directly to the PR branch (generated from the PR title via the new cicd_utils/cicd/scripts/add_changelog_entry.py helper), so the "Check for entry in Changelog" requirement passes and the entry is reviewable as part of the PR diff itself.
   • The step is idempotent and self-healing: if the bot force-pushes its branch (wiping the entry commit), the synchronize event re-adds it.
   • Enables GitHub auto-merge (squash), so the PR merges on its own once it has an approving review and all required status checks are green.
   • A heal job (on every push to main) detects open bot PRs that became conflicted — e.g., two bot PRs whose changelog entries collide once the first one merges — and resolves them by merging main into the PR branch and regenerating the entry.
3. add_changelog_entry.py: inserts - <title> ({gh-pr}N) under Unreleased changes > ### CI/CD, creating the subsection or the whole section when missing. Fully unit-tested (100% diff coverage).
4. cicd_utils/find-unmentioned-prs.sh now prints ready-to-paste changelog entries for any merged PR that's still missing from the changelog (release-time safety net).

⚠️ Recommended repo settings to complete the setup

• AUTO_MERGE_PAT secret (fine-grained PAT, this repo only, contents:write + pull-requests:write): without it, the workflow falls back to GITHUB_TOKEN, whose pushes/merges do not trigger other workflows — meaning no CI runs on the changelog commit and no post-merge CI/TestPyPI publish on main.
• Required status checks on main (Settings → Branches): auto-merge only waits for required checks. Suggested contexts: Static checks, the five Software tests (3.x, ubuntu-latest) jobs, Check for entry in Changelog, and Build distributions (leave "require branches to be up to date" off).

---

📚 Documentation preview 📚: https://ridgeplot--385.org.readthedocs.build/en/385/

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (14e872d) to head (916d9d5).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #385   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           19        19           
  Lines          674       674           
  Branches        88        88           
=========================================
  Hits           674       674           

Flag	Coverage Δ
combined-src	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0e2e719057

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Handle Dependabot with an available write token

When this job is triggered by a Dependabot PR, it matches this condition, but GitHub treats Dependabot-triggered pull_request_target runs whose PR user is dependabot[bot] as read-only and without Actions secrets (see GitHub's Dependabot-on-Actions restrictions: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-on-actions#restrictions-when-dependabot-triggers-events). That means AUTO_MERGE_PAT is unavailable and the fallback GITHUB_TOKEN cannot run the later gh pr edit/gh pr merge --auto writes, so weekly Dependabot PRs will fail this workflow instead of getting auto-merge enabled.

Useful? React with 👍 / 👎.