feat: add dependabot-rebase workflow

[don-petry]

Summary

• Adds dependabot-rebase.yml workflow that triggers on push to main and comments @dependabot rebase on behind Dependabot PRs
• Unblocks the auto-merge serialization issue caused by strict: true branch protection

Test plan

• Merge this PR (triggers the workflow on push to main)
• Verify workflow runs and comments @dependabot rebase on PR chore(deps): bump SonarSource/sonarqube-scan-action from 7.0.0 to 7.1.0 #114
• Verify Dependabot rebases chore(deps): bump SonarSource/sonarqube-scan-action from 7.0.0 to 7.1.0 #114, CI passes, and auto-merge completes

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Added automated GitHub Actions workflow to manage Dependabot pull requests. The workflow automatically detects when dependency updates fall behind the main branch and requests rebasing to keep them synchronized.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 93c4433b-f902-4b3b-b6d5-ea3eafab62f6

📥 Commits

Reviewing files that changed from the base of the PR and between 0e60dbc and b711717.

📒 Files selected for processing (1)

• .github/workflows/dependabot-rebase.yml

---

📝 Walkthrough

Walkthrough

Added a GitHub Actions workflow that automatically triggers Dependabot to rebase pull requests when they fall behind the main branch. The workflow generates a GitHub App token, identifies open Dependabot PRs, calculates how far behind each is, and posts a rebase command for those needing updates.

Changes

Cohort / File(s)	Summary
Dependabot Rebase Workflow .github/workflows/dependabot-rebase.yml	New workflow triggered on push to main that generates a GitHub App token, queries open Dependabot pull requests, checks how many commits each is behind using the GitHub API, and comments @dependabot rebase on those that need rebasing.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/add-dependabot-rebase-workflow

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Adds automation to keep Dependabot PRs up-to-date after merges to main, helping unblock auto-merge when branch protection requires strict up-to-date checks.

Changes:

• Introduces a new GitHub Actions workflow that runs on pushes to main.
• Uses a GitHub App token to detect open Dependabot PRs that are behind and posts @dependabot rebase to trigger rebases.

[Copilot]

HEAD_REF can contain slashes for Dependabot branches (e.g. dependabot/github_actions/...). In the compare API call, the head ref is part of the URL path, so unescaped / will break the request and leave BEHIND empty (causing the step to fail or skip rebases). URL-encode HEAD_REF (or switch to an API/GraphQL lookup that doesn’t require embedding the ref in the path) before calling repos/$REPO/compare/....

Suggested change

	BEHIND=$(gh api "repos/$REPO/compare/main...$HEAD_REF" \
	ENCODED_HEAD_REF=$(python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' "$HEAD_REF")
	BEHIND=$(gh api "repos/$REPO/compare/main...$ENCODED_HEAD_REF" \

[Copilot]

This will add a new @dependabot rebase comment on every push to main while a PR remains behind, which can spam PR timelines. Consider making the operation idempotent (e.g., edit the last bot comment instead of creating a new one, or check for an existing recent @dependabot rebase comment before posting).

Suggested change

	echo "PR #$PR_NUMBER ($HEAD_REF) is $BEHIND commit(s) behind — requesting rebase"
	gh pr comment "$PR_NUMBER" --repo "$REPO" \
	--body "@dependabot rebase"
	EXISTING_REBASE_COMMENT=$(gh api "repos/$REPO/issues/$PR_NUMBER/comments?per_page=100" \
	--jq 'map(select(.body == "@dependabot rebase")) | length')
	if [[ "$EXISTING_REBASE_COMMENT" -gt 0 ]]; then
	echo "PR #$PR_NUMBER ($HEAD_REF) is $BEHIND commit(s) behind — rebase already requested"
	else
	echo "PR #$PR_NUMBER ($HEAD_REF) is $BEHIND commit(s) behind — requesting rebase"
	gh pr comment "$PR_NUMBER" --repo "$REPO" \
	--body "@dependabot rebase"
	fi