Neither step did what its name said, and together they meant no Dependabot PR
was ever auto-merged — the job died before reaching the merge step.
1. "Confirm required checks are configured" failed OPEN. It read branch
protection, which GITHUB_TOKEN cannot do (administration scope is not even
a valid permissions key), so gh api returned 403 JSON into REQUIRED and
`[ "$REQUIRED" -eq 0 ]` died with "integer expression expected". A failing
test inside an `if` condition is exempt from set -e, so the guard evaluated
false and let execution continue. A guard whose whole purpose is refusing
an unsafe merge silently passed whenever it could not check.
2. "Approve low-risk Dependabot PR" can never succeed: GitHub Actions is not
permitted to approve pull requests. It is also unnecessary — these repos do
not require reviews.
The real gate is now branch protection, which as of today requires BOTH
check-commit-identity and CI on every repo, and gh pr merge --auto cannot
complete until they pass. That is stronger than the removed probe, which only
checked that some required check existed.
This makes the 13 repos match oc_guide, which already had exactly this shape
and was the only one whose auto-merge was not broken.
prompt_engineering_guide asserted the old step ORDER; its test now asserts the
invariants that still hold — no self-approve attempt, and auto-merge gated on
the low-risk update-type allowlist.
A wedged Chrome/mdPress step held a harness runner for 27 minutes yesterday
(normal run: ~4 min) and ignored `gh run cancel`; it only stopped because that
job happened to carry timeout-minutes: 30. An audit found 66 of the 101 jobs
across the cluster had no timeout at all — the same hang there would have held
a runner for GitHub's 6-hour default.
Values come from measured run history, not guesses. Across ~120 successful
runs the slowest workflow tops out at 10 min (Update Preview Publications),
CI at 6.5, Update Preview PDF at 4.8:
30 min — jobs that run Chrome/mdPress/pandoc (3x the observed max, and the
value harness already used)
15 min — release, publish, deploy, check-link, chaincode-tests
10 min — dependabot auto-merge
Every value has at least 6x headroom over its job's observed maximum, so this
should never turn a slow-but-working run into a failure.
Verified: all 72 workflow files still parse, and all 101 jobs now carry an
integer timeout in range.
yeasy
dependabot[bot]andGitHub