ci(mwpw-204835): add safe Dependabot auto-merge

[sanrai]

Summary

• run root npm Dependabot checks daily at 6:00 AM Pacific with explicit automatic rebasing
• add an observation-first controller for byte-identical, Agent-QA-approved dependency PRs
• recover stale conflicts with bounded rebase/recreate requests and human escalation
• record raised-to-decision timing on each evaluated Dependabot PR

Initial safety policy

Auto-merge eligibility is intentionally narrow:

• Dependabot-authored commits only
• direct development dependency patch/minor updates only
• only package.json and package-lock.json changed
• branch contains latest main
• build-output-diff reports NO_CHANGE
• Agent QA reports PASS for the current head SHA
• deterministic build, lint, unit, coverage, E2E, accessibility, and performance checks all pass

Anything else stays open with dependencies-needs-human. Only one eligible PR is armed at a time. Every rebase produces a new SHA that must pass the complete policy again.

Rollout

The workflow defaults to observation mode and will not merge. After reviewing several decisions:

1. Enable Allow auto-merge in repository settings.
2. Make required checks strict/up-to-date in the review-gate ruleset.
3. Set repository variable DEPENDABOT_AUTOMERGE_MODE=merge.

The controller refuses merge mode if either repository safety setting is absent.

Conflict recovery

• wait 30 minutes for Dependabot automatic rebase
• request @dependabot rebase
• after two hours, request @dependabot recreate once for untouched bot branches
• after another two hours, label for human intervention

Branches with human commits are never recreated automatically.

Validation

• node --test .github/dependabot/safe-automerge.test.mjs
• JavaScript syntax checks for the controller and Agent QA reviewer
• YAML parse validation
• git diff --check
• live-data format verification against recent Dependabot PR build(deps-dev): bump babel-jest from 30.3.0 to 30.4.1 #580

MWPW-204307 is reused because this extends that ticket’s byte-identical build-output safety layer; retitle if this rollout has a new ticket.

[github-actions]

🧪 Feature QA review — injected feature test (advisory, non-blocking)

Last updated Aug 18, 2026, 5:58 PM PT · commit 303bfd2 · pull_request.

Overall: SKIPPED

Not an injectable feature -- skipped.

This PR is a CI/workflow automation change (Dependabot auto-merge controller) with no card-collection config/data-driven UI behavior to exercise in a rendered page.

This PR's change isn't driven by config/collection data the harness can force, and the build-output-diff verdict wasn't available to consult. (The visual/smoke review still applies.)

Screenshot in the workflow run.

Review history (3 runs)

• Aug 18, 2026, 5:58 PM PT · SKIPPED · 303bfd2 · pull_request
• Aug 18, 2026, 5:48 PM PT · SKIPPED · 86e125d · pull_request
• Aug 18, 2026, 5:37 PM PT · SKIPPED · 4a8c09d · pull_request

[github-actions]

AI Code Review

Last updated Aug 18, 2026 5:58 PM PDT · new commit pushed · commit c5f5ea6 · 6 files changed in PR.

0 open · 1 resolved · this run: 1 marked resolved

Open findings

No open findings. ✅

✅ Resolved

• 🟠 Merge arming check uses pre-loop PR snapshot after disabling stale auto-merge — resolved in c5f5ea6

Review history (3 runs)

• c5f5ea6 · Aug 18, 2026 5:58 PM PDT · new commit pushed · 1 resolved (0 open) — ci(mwpw-204307): add safe Dependabot auto-merge
• 2098f9b · Aug 18, 2026 5:51 PM PDT · new commit pushed · +1 new (1 open) — ci(mwpw-204307): add safe Dependabot auto-merge
• cb3ea34 · Aug 18, 2026 5:37 PM PDT · PR opened · no changes (0 open) — ci(mwpw-204307): add safe Dependabot auto-merge

[github-actions]

Agent QA review — interactive + visual diff (advisory, non-blocking)

Last updated Aug 18, 2026, 5:57 PM PDT · new commit pushed · commit c5f5ea6 · 6 files changed.

0 open · 0 resolved · visual diff 0.00% · verdict PASS

Open findings

• Smoke test passed ✅

What the agent checked

Reviewed PR #583 against the live business.adobe.com/resources/main.html page with the PR's CaaS build injected.

Context: PR #583 is a CI/automation-only change (Dependabot auto-merge controller, workflow YAML, docs, and its unit tests). It touches no front-end/CaaS rendering code. This matches the supplied pixel-diff artifact, which showed 0.00% of pixels changed and no magenta/highlighted regions anywhere on the page — i.e. the diff tool confirms there is no visual delta between the PR build and stable build to investigate.

Given that, I performed a general regression pass of the live Resource Center (CaaS) page to confirm the injected PR build did not silently break anything:

1. Initial page load: Header/nav, breadcrumb, hero, and "Explore all Adobe resources" heading all render correctly, no layout shifts or missing assets.
2. CardsGrid (data-testid=consonant-CardsGrid): Cards render in a clean 2-column grid with images, titles, descriptions, and "Read article"/"Read now" CTAs all properly aligned. Scrolled through multiple rows — no truncated text, no broken images, no overlapping elements.
3. LeftFilters panel (data-testid=consonant-LeftFilters): "Refine Your Results" panel with result count (3834 results), Sort by dropdown, Search box with clear button, and three collapsible filter groups (Products, Content Type, Industry) all present and functioning. Clicking "Products" correctly expanded an accordion listing 48 checkbox options (Acrobat, Acrobat Sign, Advertising, Analytics, Brand Visibility, Campaign, Commerce, Creative Cloud, Customer Journey Analytics, Forms, etc.) with proper checkbox inputs and labels — confirmed via DOM query (48 checkboxes found, correctly labeled).
4. Console errors: Only one benign message — "Permissions policy violation: unload is not allowed in this document" — which is unrelated to this PR and commonly seen on Adobe.com pages using the unload event for analytics; not a functional regression.
5. Accessibility: Ran axe-core scoped to the LeftFilters panel — 0 violations, 22 passes, 0 incomplete. No color-contrast, label, or ARIA issues detected in the filter UI.

No visual, functional, console, or accessibility regressions were found on the live page with the PR build injected. This is expected, since the PR only modifies GitHub Actions CI/CD workflow files, documentation, and a Node.js automation script for Dependabot PR handling — none of which affect the deployed front-end bundle. The 0.00% pixel diff and clean manual QA pass are consistent with the change's scope.

Verdict: PASS — no regressions found; PR is CI-infrastructure-only and does not affect the rendered page.

PR / stable / diff screenshots + console + axe artifacts in the workflow run.

Review history (3 runs)

• c5f5ea6 · Aug 18, 2026, 5:57 PM PDT · new commit pushed · passing, no regressions — ci(mwpw-204307): add safe Dependabot auto-merge
• 2098f9b · Aug 18, 2026, 5:50 PM PDT · new commit pushed · passing, no regressions — ci(mwpw-204307): add safe Dependabot auto-merge
• cb3ea34 · Aug 18, 2026, 5:43 PM PDT · PR opened · passing, no regressions — ci(mwpw-204307): add safe Dependabot auto-merge