[loks0n]

Replaces this repo's dependabot-auto-merge.yml with a call to the shared workflow from appwrite/.github#132, pinned to its merge commit.

The shared gate runs after each workflow a PR triggers, from the default branch, so a PR can't change it. For a Dependabot patch or minor update it waits for every workflow run, check run and commit status on the exact head SHA, approves when all of them pass, and merges with --match-head-commit. Majors and failures stay for a human. Because it merges directly, the repo doesn't need Allow auto-merge or required status checks.

Adds cooldown: default-days: 7 to every update entry, matching appwrite/appwrite, so a release is a week old before Dependabot proposes it. That gives a compromised release time to get yanked before it's auto-merged. Security updates ignore cooldown.

Part of fixing Dependabot auto-merge across both orgs: 0 bot merges in 30 days, 266 open PRs.

🤖 Generated with Claude Code

[hansi-codes]

🟢 Tier S · Ready to merge

The workflow-runs permission raised in the open finding is now present, and this incremental change introduces no remaining issue.

This pull request replaces the repository-local Dependabot auto-merge job with a pinned shared workflow invoked after CI completes, and adds a seven-day cooldown to npm and GitHub Actions updates. The shared gate evaluates checks on the exact Dependabot commit before approving and merging eligible patch and minor updates.

Latest changes: The newest commit grants the workflow actions: read permission so the shared gate can inspect workflow runs.

Verdict	New comments	Fixed	Still open
✅ Approved	0	1	0

📂 Walkthrough · 2

File	Change
.github/dependabot.yml	Adds a seven-day cooldown for npm and GitHub Actions version updates.
.github/workflows/dependabot-auto-merge.yml	Invokes the pinned shared auto-merge workflow after CI completes, with permissions for reading workflow runs, checks, and statuses and updating pull requests.

✅ Fixed since the last review · 1

• Grant read access to Actions workflow runs · .github/workflows/dependabot-auto-merge.yml:13

---

_{Reviewed the commits since 41bb480 · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟡 Tier B · 1 blocking finding to address. Summary

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary