Dependabot auto-merge + verify-or-revert on the website deploy

[rrrutledge]

What this does

Automates Dependabot dependency bumps for /scripts, gated on the real deploy signal: the Publish to website workflow, which regenerates the learning-path markdown and pushes it into the innersourcecommons.org repo. That workflow only runs post-merge (never on the PR), so the only way to know a bump breaks the deploy is to merge it and watch - which is what this pair does.

Two workflows:

dependabot-auto-merge.yml - on a Dependabot PR, reads the update type and, for patch/minor only, auto-approves and enables auto-merge (squash). Major bumps wait for a human, because majors are what have broken the deploy before (asciidoctor 3 → 4 broke it and stayed broken for ~2 months).

revert-bump-on-failed-deploy.yml - when Publish to website fails on a push to main whose commit is a Bump ... (Dependabot), it opens a PR reverting that commit, @-mentions @InnerSourceCommons/learning-path, and enables auto-merge on the revert.

What's automatic vs. what still needs a human

• Patch/minor bumps merge with no human involvement.
• A broken deploy is auto-reverted into a PR and the maintainers are notified automatically.
• The revert PR's final merge still needs one approving review (branch protection). That approval is deliberate - it's also the backstop against a false revert, since a deploy can occasionally fail for a reason unrelated to the bump that triggered the run. To make the revert fully hands-off, a GitHub App token could act as a second identity to approve the revert PR; the default token can't approve a PR it opened.

To activate (after merge)

1. Enable Settings → General → Allow auto-merge on this repo (currently off). Both workflows use it.
2. (Already on) "Allow GitHub Actions to create and approve pull requests".

That's it - no secrets required for this version.

Honest limitations

• Misattribution: the bump that triggers a failing run isn't always the bump that broke it (a prior breaking bump leaves the build red). The maintainer review on the revert PR catches this.
• Flaky failures can trigger a revert PR; again caught at the review gate.
• Not committed to main - this is a draft for review.

🤖 Generated with Claude Code

https://claude.ai/code/session_018zv3SKYNduHEhVyNWLb3Xh