chore(deps): bump embeddedos-org/.github/.github/workflows/linked-issue-policy.yml from 92cb596c773496ec4df76717e8acf0e6b7700f73 to 186aef0da86d36f8ad72f091d80bb187226b9444

[dependabot]

Bumps embeddedos-org/.github/.github/workflows/linked-issue-policy.yml from 92cb596c773496ec4df76717e8acf0e6b7700f73 to 186aef0da86d36f8ad72f091d80bb187226b9444.

Commits

• 186aef0 Merge pull request #6 from embeddedos-org/governance/community-control-plane
• 2faddce fix(governance): match GitHub discussion category casing
• 6343009 docs(governance): add agent guidance and wiki snapshot
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[srpatcha]

Review — eIPC#40 "chore(deps): bump embeddedos-org/.github/.github/workflows/linked-issue-policy.yml from 92cb596c to 186aef0d"

head: 9a06756 author: app/dependabot ci: pass (3/3 green; assign skipping)

Verdict: Clean and merge-safe. Evidence: linked-issue-policy.yml is byte-identical at both SHAs (diff of the two blobs is empty), so this bump cannot change what CI does — the SHA moved because unrelated files in embeddedos-org/.github changed. policy / Policy / Linked Issue passes on this head. Two notes below, neither blocking.

Findings

#	Severity	File:line	Finding	Recommended fix
1	Low	.github/dependabot.yml:23,62	Dependabot's own comment on this PR — "The following labels could not be found: github-actions" — is a real repo-config defect, not noise, and it recurs on every PR the bot opens here. The repo's label is github_actions (underscore); the config asks for github-actions (hyphen). :62 additionally asks for go, which does not exist either — the repo has 23 labels and neither github-actions nor go is among them.	One character for the first: github-actions → github_actions at :23. For the second, either gh label create go or drop go from the Go ecosystem's labels: block at :62.
2	Low	.github/workflows/linked-issue.yml:14-16	uses: moves to 186aef0d while policy_ref: stays at 92cb596c, so the two pins now name different commits. This is by design, not a defect — the reusable workflow documents the input as "Full commit SHA in embeddedos-org/.github containing the reviewed policy" and checks that ref out separately (actions/checkout with path: policy) to run policy/scripts/validate_linked_issue.py against policy/governance/repositories.json. Pinning the reviewed policy apart from the workflow machinery is the whole point: bumping one must not silently adopt new policy rules. The maintenance risk is that Dependabot updates uses: forever and will never update policy_ref, so the reviewed policy drifts arbitrarily far behind, and the day the newer workflow needs a script or registry shape the older ref does not have, the break lands as a red required check across all 19 repos at once.	No change to this PR. Add a comment above policy_ref: recording that the divergence is intentional, so a future reader does not "fix" it by syncing the two. Separately, give the policy ref a deliberate review-and-bump cadence rather than leaving it to drift.

Architecture conformance

Conforms, and §5.1 is not engaged: this is a CI workflow reference, not an #include, import, link line or manifest dependency, so nothing becomes a runtime dependency of eIPC (Tier 2 — Core Platform, master design §21). embeddedos-org/.github is Infrastructure in §21's taxonomy, which is where governance and release automation belong, so a Tier-2 repo consuming a reusable policy workflow from it is the intended direction. No tier-placement or §21.1 split question arises.

The change touches one line of one workflow and no production code, so brief §8 (API and wire compatibility) and §9 (performance) do not apply.

Proposed changes

Merge as is. Handle finding 1 in a separate one-line commit to .github/dependabot.yml; it is unrelated to this bump and should not be folded into a bot branch. Finding 2 is a comment, also separate.

Not checked

• Nothing was executed. No workflow was run and no test was run by this review.
• What I did verify, by API rather than by execution: linked-issue-policy.yml at 92cb596c and at 186aef0d are identical (diff returns nothing); scripts/validate_linked_issue.py has the same blob SHA at both refs; governance/repositories.json differs, and the whole difference is one capitalisation in a discussion-category name ("Show and Tell" → "Show and tell"), which validate_linked_issue.py does not consume for linked-issue validation. The comparison spans 3 commits touching AGENTS.md, six docs/wiki/*.md files and governance/repositories.json.
• I did not run validate_linked_issue.py against either registry to confirm the capitalisation change is inert for this check. That it is inert is Inferred from the field's name and location, not observed.
• Whether any other repo in the org pins a different policy_ref — and therefore whether the org is already running several policy versions at once — was not checked.
• mergeable / mergeStateStatus were not usable in the bundle, so whether this branch still merges cleanly onto master is unconfirmed.

---

Automated architecture review of 9a06756942ff — scheduled, model claude-opus-5, checked against the EmbeddedOS Master Design v2.0. Advisory only: this reviewer never approves, requests changes, or merges. Reply here to discuss or push back — a wrong finding is a bug worth reporting.