dependabot: never auto-merge a breaking update; never overwrite a repo's own dependabot.yml

[avrabe]

Closes #71.

Two maintainer decisions

1. Auto-merge is armed only for non-breaking updates.
src/dependabot-update-type.js reads every update a Dependabot PR makes and refuses to arm if any is breaking. It uses the leftmost-non-zero rule that Cargo and npm carets use: a major bump, a 0.x minor, or a 0.0.x patch counts as breaking. When temper refuses, it leaves a comment giving the reason.

• For a grouped PR, it reads the Updates \x` from … to …` lines, because the title has no versions. witness#211, "the wasmtime group", actually carries 47 → 48.
• It reads only the summary lines Dependabot writes itself, not the upstream release notes quoted in the body. Those often say things like "migrate from 2.0.0 to 9.0.0".
• If it can't read a version as semver (an unrecognised title, or an action pinned to a commit SHA), it refuses. A wrong refusal costs one manual merge. A wrong allow merges a breaking change nobody reviewed.

Why CI can't decide this: a green PR proves nothing for an action whose changed code only runs on a tag or a manual dispatch. On varve, cosign sign-blob runs only in the release workflow and setup-oras only in a dispatch-triggered deposit workflow. Before this change, varve#152 (a toml major bump) was merged automatically.

2. temper writes .github/dependabot.yml only if the repository has none.
If the file exists, it belongs to the repository. It holds choices temper can't know: which updates to group, which majors to hold, which paths PR CI never runs. For example, varve groups minor and patch updates (varve#160), and the generic org config would undo that. The check lives in applyDependabotConfig, so /configure-repo, /generate-dependabot and the scheduler can't behave differently. If the existence check fails with a 403 or 500, temper throws an error. It doesn't treat the file as missing. /generate-dependabot now says the config was not applied, where before it said "✅ applied!" either way.

Evidence

• Unit tests use real title and body strings from Dependabot PRs in the org.
• Handler tests check that a non-breaking PR gets auto-merge, that cosign 3.9.1→4.1.2 and a grouped wasmtime major are refused with a comment, and that thrum is unaffected.
• Negative controls:
  • Disabling the existence check fails 3 tests.
  • Treating every error as a missing file fails 1.
  • Removing the refusal fails the handler test.
• Full suite: 867/867 pass. eslint is clean.

Note: temper only arms auto-merge on pull_request.opened. Dependabot PRs that are already open keep whatever state they have now.

🤖 Generated with Claude Code

https://claude.ai/code/session_019TNtfRjLNhEz82G2ggeeNu

[temper-pulseengine]

Automated review for PR #72

pulseengine/temper:fix/dependabot-semver-and-repo-owned-config → pulseengine/temper:main

Verdict: 💬 Comment

Summary: This pull request introduces a new module dependabot-update-type.js that provides functions to parse version numbers and determine if updates are breaking. It also includes a function dependabotAutoMergeDecision that uses these utilities to decide whether a Dependabot PR should be auto-merged based on the updates it contains. The pull request is well-documented and follows the guidelines for a

Findings: 0 mechanical (rivet) · 1 from local AI model.

Findings (1):

1. src/dependabot-update-type.js:134

   return { allow: true, reason: `${updates.length} non-breaking update(s)` };
   

   The function dependabotAutoMergeDecision correctly returns a decision based on the number of non-breaking updates in a Dependabot PR.

---

Generated by a local AI model and post-validated against a strict JSON contract. Each finding includes the verbatim line being criticised — verify by reading the file at the cited location.

Reviewed at 75c2a9e