Fix Dependabot review query crashing on jq arguments

[jonathanKingston]

Asana Task/Github Issue: Found while reviewing open Dependabot PRs (#2975, #3016).

Description

When the Dependabot gate declines an update, its latest-review lookup crashes because gh --jq does not accept jq's --arg option. Pipe the paginated JSON to jq and combine pages before choosing the latest decision. This preserves the existing review policy and lets the workflow complete its review/assignment steps.

Testing Steps

• Validated empty reviews, matching head, stale head, and a later approval on a second page using the exact workflow jq expression.
• Ran the existing Dependabot gate unit tests.
• Reproduced the invalid command in the failing GitHub Actions logs.

Checklist

• I have tested this change locally
• I have tested this change locally in all supported browsers
• This change will be visible to users
• I have added automated tests that cover this change
• I have ensured the change is gated by config
• This change was covered by a ship review
• This change was covered by a tech design
• Any dependent config has been merged

---

Note

Low Risk
Single-line workflow shell fix for a broken jq invocation; no application or auth logic changes.

Overview
Fixes the Defer to human reviewer step in the Dependabot auto-merge workflow when Anthropic declines an update. The latest-review idempotency check was calling gh api with --jq --arg, which fails because GitHub CLI’s --jq does not forward jq’s --arg.

The lookup now pipes paginated review JSON through jq (gh api … --paginate --slurp | jq --arg sha …) and flattens pages with .[][] before picking the last daxtheduck decision. Behavior is unchanged: skip posting another REQUEST_CHANGES when one already exists on the current head SHA.

^{Reviewed by Cursor Bugbot for commit c670168. Bugbot is set up for automated code reviews on this repo. Configure here.}

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[cursor]

Stale comment

Web Compatibility Assessment

No findings. This PR touches only .github/workflows/dependabot-auto-merge.yml (CI automation). Zero changes under injected/, messaging/, special-pages/ runtime code, or platform entry points — nothing is bundled into DuckDuckGo browsers.

---

Security Assessment

No findings. The diff fixes a gh api + jq invocation in the Dependabot auto-merge workflow:

• Before: gh api … --paginate --jq --arg sha … — gh's built-in --jq does not forward jq CLI flags like --arg, causing the step to crash instead of evaluating the idempotency check.
• After: gh api … --paginate --slurp | jq --arg sha … — pipes paginated JSON pages to standalone jq, using [.[][] | …] to flatten multi-page results before selecting the latest daxtheduck review.

$PR_HEAD_SHA is sourced from the GitHub Actions context (not arbitrary page input). No messaging trust boundaries, captured globals, API overrides, or secret-handling changes.

Info (pre-existing, out of scope): The approved_ids query immediately above (L231–232) still uses per-page --paginate --jq without --slurp. On PRs with many reviews spanning multiple API pages, dismissals could theoretically miss older APPROVED reviews. This PR does not change that path.

---

Risk Level

Low Risk — CI-only workflow bugfix for a crashing jq idempotency guard; no injected runtime, messaging, or browser API surface changes.

---

Recommendations

1. Merge when green — change is narrowly scoped and correct for the reported crash.
2. Optional follow-up (info): Consider applying the same --paginate --slurp | jq pattern to the approved_ids dismissal loop (L231–232) for consistent pagination handling on review-heavy PRs.

  

_{Sent by Cursor Automation: Web compat and sec}

[github-actions]

Build Branch

Branch	pr-releases/codex/fix-dependabot-review-query
Commit	dd4b7cff53
Updated	September 11, 2026 at 11:08:53 PM UTC

Static preview entry points

• Docs: docs/index.html
• Static pages: build/integration/pages/index.html
• Integration pages: injected/integration-test/test-pages/index.html

QR codes (mobile preview)

Entry point	QR code
Docs
Static pages
Integration pages

Integration commands

npm (Android / Extension):

npm i github:duckduckgo/content-scope-scripts#pr-releases/codex/fix-dependabot-review-query

Swift Package Manager (Apple):

.package(url: "https://github.com/duckduckgo/content-scope-scripts.git", branch: "pr-releases/codex/fix-dependabot-review-query")

git submodule (Windows):

git -C submodules/content-scope-scripts fetch origin pr-releases/codex/fix-dependabot-review-query
git -C submodules/content-scope-scripts checkout origin/pr-releases/codex/fix-dependabot-review-query

Pin to exact commit

npm (Android / Extension):

npm i github:duckduckgo/content-scope-scripts#dd4b7cff538b749b516b607aba43e35e063abad1

Swift Package Manager (Apple):

.package(url: "https://github.com/duckduckgo/content-scope-scripts.git", revision: "dd4b7cff538b749b516b607aba43e35e063abad1")

git submodule (Windows):

git -C submodules/content-scope-scripts fetch origin pr-releases/codex/fix-dependabot-review-query
git -C submodules/content-scope-scripts checkout dd4b7cff538b749b516b607aba43e35e063abad1

[github-actions]

[Beta] Generated file diff

Time updated: Fri, 11 Sep 2026 23:09:09 GMT

Dismissing stale approval — new commits pushed, awaiting Cursor re-review.

[cursor]

Web Compatibility Assessment

No findings. This PR modifies only .github/workflows/dependabot-auto-merge.yml — GitHub Actions CI infrastructure. There are zero changes under injected/, messaging/, special-pages/, or any bundled artifacts that execute in DuckDuckGo browsers. No browser API overrides, DOM interaction, prototype modifications, or platform entry-point changes are present.

---

Security Assessment

No findings. The change fixes a broken gh api --jq --arg invocation in the Dependabot auto-merge workflow's idempotency check. It does not touch:

• captured-globals.js, messaging transports, or the message bridge
• Origin validation, postMessage, or nativeData handling
• Remote config, feature gating, or exemption logic
• Any code that runs in a web page context

The workflow logic is unchanged in intent: skip posting a duplicate REQUEST_CHANGES review when daxtheduck already requested changes on the current head SHA.

---

Risk Level

Low Risk — CI-only shell fix for a paginated jq query; no application runtime, messaging, or browser-injection code is affected.

---

Recommendations

No action required from a web compatibility or security perspective.

Info (workflow correctness): The fix correctly separates gh api --paginate --slurp from jq --arg, which gh --jq cannot forward. Using [.[][] | …] properly flattens paginated review pages before last selects the latest daxtheduck decision — an improvement over per-page --jq filtering when review history spans multiple API pages.

  

_{Sent by Cursor Automation: Web compat and sec}