fix: use GITHUB_TOKEN for dependabot rebase workflow

[don-petry]

Summary

• Switches from GitHub App token to GITHUB_TOKEN with pull-requests: write for the @dependabot rebase comment
• Dependabot requires the commenter to have push access as a user; GitHub App bot accounts are not recognized for this

Follows up on #125 where the initial implementation used the app token and Dependabot rejected the command.

Test plan

• Merge this PR (triggers the workflow on push to main)
• Verify github-actions[bot] comment is accepted by Dependabot
• Verify Dependabot rebases PR chore(deps): bump SonarSource/sonarqube-scan-action from 7.0.0 to 7.1.0 #114

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Added a new GitHub Actions workflow that automatically rebases Dependabot pull requests whenever they fall behind the main branch. The workflow triggers on pushes to main, identifies outdated Dependabot PRs, and initiates automatic rebases to keep dependencies current.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

A new GitHub Actions workflow was added to automatically rebase Dependabot pull requests that fall behind the main branch. The workflow triggers on every push to main, queries open Dependabot PRs via GitHub API, checks each PR's commit distance from main, and posts a @dependabot rebase comment when needed.

Changes

Cohort / File(s)	Summary
Dependabot rebase automation .github/workflows/dependabot-rebase.yml	New workflow that triggers on pushes to main, fetches all open Dependabot PRs, compares each PR branch against main to determine how many commits it is behind, and posts a rebase comment when necessary.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• feat: add dependabot-rebase workflow #125: Implements the same Dependabot rebase automation workflow with identical functionality but using GitHub App authentication instead of GITHUB_TOKEN.

Suggested reviewers

• Copilot

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix: use GITHUB_TOKEN for dependabot rebase workflow' directly addresses the main change: replacing a GitHub App token with GITHUB_TOKEN in the workflow to fix permission issues.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dependabot-rebase-permissions

⚔️ Resolve merge conflicts

• Resolve merge conflict in branch fix/dependabot-rebase-permissions

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Updates the Dependabot rebase automation workflow so it comments @dependabot rebase using the built-in GITHUB_TOKEN (with pull-requests: write), aligning with Dependabot’s requirement that the commenter has push access as a user.

Changes:

• Configure the rebase workflow to authenticate gh via GITHUB_TOKEN.
• Detect open Dependabot PRs that are behind main and comment @dependabot rebase to request a rebase.

[Copilot]

HEAD_REF from Dependabot PRs typically contains slashes (e.g. dependabot/npm_and_yarn/...). Using it unescaped inside the REST path compare/main...$HEAD_REF will produce an invalid URL (extra path segments), causing gh api to 404 and the step to fail under the default bash -e runner shell. URL-encode the ref before calling the compare endpoint (or fetch the behind count via a PR/GraphQL field that doesn't require embedding the ref in the URL path).

Suggested change

	BEHIND=$(gh api "repos/$REPO/compare/main...$HEAD_REF" \
	ENCODED_HEAD_REF=$(python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1], safe=""))' "$HEAD_REF")
	BEHIND=$(gh api "repos/$REPO/compare/main...$ENCODED_HEAD_REF" \

[Copilot]

The header comment Copy to .github/workflows/dependabot-rebase.yml is misleading now that this file already lives at that path. Consider removing or rewording it to describe the workflow’s purpose instead of implying it’s a template to be copied.

Suggested change

	# Copy to .github/workflows/dependabot-rebase.yml
	# Rebases open Dependabot PRs that have fallen behind main after pushes.