Compliance: non-stub-dependabot-automerge.yml

[don-petry]

Compliance Finding

Category: ci-workflows
Severity: error
Check: non-stub-dependabot-automerge.yml

Detail

Centralized workflow dependabot-automerge.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/dependabot-automerge.yml which delegates to petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1.

Standard Reference

standards/ci-standards.md#centralization-tiers

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

---

This issue was automatically created by the weekly compliance audit.

[don-petry]

Claude finished @don-petry's task in 1m 39s —— View job • claude/issue-149-20260501-1332 • [Create PR ➔](https://github.com/petry-projects/TalkTerm/compare/main...claude/issue-149-20260501-1332?quick_pull=1&title=Issue%20%23149%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%23149%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

---

Fixing Compliance Issue: dependabot-automerge.yml

• Gather context and analyze issue
• Read current dependabot-automerge.yml
• Fetch canonical stub template from org standards
• Apply template fix — replaced SHA-pinned @ee22b427...# v1 with canonical @v1
• Commit and push changes
• Create pull request — petry-projects/TalkTerm#154
• Self-review PR — single-line change, no issues found
• Tagged @don-petry (CODEOWNERS) to review and merge

Summary

The .github/workflows/dependabot-automerge.yml file had a SHA-pinned reference to the reusable workflow (@ee22b427cbce9ecadcf2b436acb57c3adf0cb63d # v1) rather than the canonical @v1 tag required by the org standard. The file is now verbatim from petry-projects/.github/standards/workflows/dependabot-automerge.yml.
| View PR #154

[don-petry]

Weekly Compliance Audit (2026-05-08)

This finding is still open.

Detail: Centralized workflow dependabot-automerge.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/dependabot-automerge.yml which delegates to petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1.

Standard: standards/ci-standards.md#centralization-tiers

[don-petry]

Weekly Compliance Audit (2026-05-11)

This finding is still open.

Detail: Centralized workflow dependabot-automerge.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/dependabot-automerge.yml which delegates to petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1.

Standard: standards/ci-standards.md#centralization-tiers

[don-petry]

Weekly Compliance Audit (2026-05-12)

This finding is still open.

Detail: Centralized workflow dependabot-automerge.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/dependabot-automerge.yml which delegates to petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1.

Standard: standards/ci-standards.md#centralization-tiers

[don-petry]

Weekly Compliance Audit (2026-05-12)

This finding is still open.

Detail: Centralized workflow dependabot-automerge.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/dependabot-automerge.yml which delegates to petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1.

Standard: standards/ci-standards.md#centralization-tiers

[don-petry]

Weekly Compliance Audit (2026-05-12)

This finding is still open.

Detail: Centralized workflow dependabot-automerge.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/dependabot-automerge.yml which delegates to petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1.

Standard: standards/ci-standards.md#centralization-tiers

[don-petry]

Weekly Compliance Audit (2026-05-12)

This finding is still open.

Detail: Centralized workflow dependabot-automerge.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/dependabot-automerge.yml which delegates to petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1.

Standard: standards/ci-standards.md#centralization-tiers