Verify Dependabot cooldown + auto-merge + OSV-Scanner in production

[viniciusdc]

Tracking issue for verifying the changes in #36 once they're merged and repo settings are flipped. The work cannot be tested on the PR itself — it requires a real Dependabot PR cycle to observe.

Repo settings to flip (one-time)

• Settings → General → Pull Requests → Allow auto-merge — enabled via gh api ... -F allow_auto_merge=true
• Settings → Actions → General → Workflow permissions → Read and write permissions — already write with can_approve_pull_request_reviews: true
• Settings → Branches → branch protection on main → Require status checks — scan-pr / osv-scan added to existing required checks (Build, Spell check, Lighthouse audit). strict: false, no required reviews, no admin enforcement — compatible with Dependabot auto-merge.

Verifications on the next Dependabot PR cycle

• Next Dependabot run honors cooldown — no PRs opened for releases younger than the per-semver thresholds (npm: 1d patch / 3d minor / 7d major).
• On the first patch/minor PR opened after settings are flipped: Dependabot auto-merge / Enable auto-merge for patch/minor job runs and GitHub displays "Auto-merge enabled" on the PR.
• On the first major PR opened: the auto-merge job runs but does NOT enable auto-merge (skip step is the only step that fires).
• OSV-Scanner / scan-pr runs and reports green on a clean PR.
• Once a patch/minor PR has all checks green, it merges automatically without manual intervention.

Notes on the stale PRs

PRs #31–#34 (astro, puppeteer, tailwindcss, shadcn) were opened before this change and won't retroactively pick up cooldown rules. They will pick up the auto-merge workflow once they re-trigger (e.g. on a rebase or new push) — or they can just be merged manually.

PRs #22 and #18 (content PRs predating the OSV-Scanner workflow) will now be blocked by the new scan-pr / osv-scan required check until they're rebased onto main (or you push a no-op commit to re-trigger CI).

[viniciusdc]

Closing — the infrastructure has now had a real Dependabot cycle and the verifications are mostly answerable.

Confirmed in production:

• Cooldown — PR chore: bump tailwindcss from 4.2.4 to 4.3.0 #33 (tailwindcss) was closed by Dependabot during its soak window because a newer release dropped. Exactly the behavior the cooldown is meant to produce.
• Patch/minor auto-merge — landed cleanly on chore: bump puppeteer from 24.42.0 to 24.43.0 #32 (puppeteer), chore: bump shadcn from 4.6.0 to 4.7.0 #34 (shadcn), chore: bump @tailwindcss/vite from 4.2.4 to 4.3.0 #47, chore: bump @astrojs/mdx from 5.0.4 to 5.0.6 #48, chore: bump astro from 6.3.1 to 6.3.3 #49 once their checks went green.
• OSV-Scanner gates on real vulns — caught `yaml@2.7.1` (GHSA-48c2-rrv3-qjmp) during the chore: declare @astrojs/check and typescript as devDependencies #50 / design: personal-notebook direction (proof of concept) #42 rebases and blocked merge until it was overridden to `^2.8.3`. Without it, that would have shipped silently.
• Auto-merge robust to transient GitHub 504s — PR chore: bump astro from 6.2.1 to 6.3.1 #31 hit a real "Unicorn!" 504; hardened with a retry loop in chore: retry enable-auto-merge on transient GitHub 504s #39.

Unobservable through normal operation:

• Major bump skip — the only ignored-major was puppeteer, which we removed entirely. No remaining dep has an ignore rule, so this branch can't be exercised without contrived setup. Worth verifying in passing if a real major bump ever arrives, but not worth a tracking issue.

System is working as designed. Closing.