redis-objects-periodical 0.7.0 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: be8af0088e6ff4a0d8e8e26185acd940452d08f123b1820eef198f636db7b1f7
-  data.tar.gz: 3cd7b2fbb4ea2fd2bd6e53c3d0798ec4bb1e93b89760a4a6fec48b0215fc072e
+  metadata.gz: 4ce017da5d08688b7f71334c77d3a1c6a8db2b6029a5be69924b0e62c6948c0b
+  data.tar.gz: cf73b3a83c8ac045f9800af654e048d4290a7d3732e2a8de2da71a7e2b354a22
 SHA512:
-  metadata.gz: 284c3aca951719e4efd85195dbd6457061732a1507821b173cf8e61e879e75fc751694b2540b6716b087ec311ad71c3c9e6d59a29f46f25552e0ae5586baf715
-  data.tar.gz: 5fafbcc175c1303535e6e23ee9df14f41a1db5006515416171f15e73f38ee5192e6a0b9adfa6fdfb1ef94c351768bd543c7d9b08e1ce8d1e1de0ac84f621ae1b
+  metadata.gz: 5c44b80f46477aab2384b225a209a26373a357589e21b651556aab74926aa0369d945a6e6357f85600144b2cc2517ada7b2e6b17dd7ecf037a2fae3cd6441657
+  data.tar.gz: 0c5296dc39927ba464aacf5586de4c2810980d1e4e38c4c2a35e52ce5a711e8858213265d0798c3791ebb01d870e0d8eb1f06d32a5f9008c82bea21f9c5b0c57

data/.agents/skills/dependabot-batch-maintenance/SKILL.md

@@ -0,0 +1,141 @@
+---
+name: dependabot-batch-maintenance
+description: Review Dependabot pull requests in this repository and merge an authorized batch one at a time, preserving exclusions and checking compatibility, refreshed branches, current-head CI, and integration results. Use for review-only requests without performing mutations.
+---
+
+# Dependabot batch maintenance
+
+## Scope and authorization
+
+- Establish the user's targets, exclusions, and holds before starting.
+- For review-only requests, do not post comments, update branches, or merge.
+- When batch merging is authorized, continue through eligible PRs without asking
+  for confirmation for each PR.
+- Preserve an excluded update even if Dependabot recreates it under a new PR
+  number. Match exclusions by dependency and update, not only by PR number.
+- Releases, support-policy changes, and GitHub protection changes are outside
+  this workflow unless separately authorized.
+
+## Repository sources
+
+Read the current versions of these sources at the start:
+
+- [AGENTS.md](../../../AGENTS.md): checkout, compatibility, and validation rules.
+- [CONTRIBUTING.md](../../../CONTRIBUTING.md): development and verification commands.
+- [Maintaining](../../../docs/maintaining.md#dependency-updates-and-auto-merge):
+  dependency update and auto-merge procedures.
+- [Workflows](../../../.github/workflows/) and
+  [Dependabot policy](../../../.github/scripts/dependabot-policy.cjs): actual
+  check configuration and automated merge eligibility.
+- Current GitHub branch protection, effective rulesets, and required checks.
+
+Do not hard-code check names, supported Ruby versions, dependency versions, or
+PR numbers in this skill. Derive them from the current sources above.
+
+An update outside the automated merge allowlist can still pass individual
+review. Major updates require compatibility review rather than automatic
+rejection. Return decisions about support policy or public compatibility to the
+user when they are outside the authorized scope or remain unresolved.
+
+## Establish the batch
+
+1. Check the checkout, branch, Git status, and worktree list.
+2. List open Dependabot PRs and verify their actual author and update targets.
+3. Separate candidates, exclusions, and holds.
+4. For each candidate, record its PR number, old and new versions, head SHA,
+   base SHA, changed files, CI results, and existing reviews.
+
+Distinguish replacements for original candidates from unrelated PRs created
+after the batch started. Review replacements within the original scope and
+preserve exclusions. Report unrelated new updates rather than extending the
+batch indefinitely.
+
+## Review each PR
+
+Process one PR at a time.
+
+### Inspect the update
+
+- Read official release notes and changelogs, and inspect upstream diffs when
+  needed. Compare breaking changes with actual usage in this repository.
+- Review the complete PR diff for unrelated edits, unexpected dependency
+  updates, and changes to constraints, platforms, or sources.
+- For Bundler updates, inspect Ruby requirements and transitive dependencies.
+  When a shared dependency appears in both the root and optional ActiveSupport
+  environments, verify consistency across both lockfiles.
+- For Actions updates, verify that the pinned SHA corresponds to the intended
+  official release. Review the Node runtime, inputs, outputs, script APIs,
+  permissions, triggers, and executable code affected by the update.
+
+### Refresh a stale branch
+
+- Do not treat CI against an old base as validation against current master.
+- If a refresh is needed, use one update mechanism at a time.
+- After requesting `@dependabot rebase`, wait for the head to change or for
+  Dependabot to report the outcome. Do not immediately also run
+  `gh pr update-branch` or post another refresh request.
+- Space status reads apart. If the operation remains pending, preserve that
+  state and report it rather than repeatedly requesting the same update.
+- Use `@dependabot recreate` when rebase has failed and regeneration is
+  appropriate. Check for manual changes before allowing recreation to overwrite
+  them; skip if their disposition is unclear.
+- Bound retries: if one rebase attempt and one appropriate recreation attempt
+  do not resolve the problem, skip the PR and record the reason.
+
+Whenever the head changes, re-inspect the complete diff and obtain verification
+results for the new head. Do not reuse approval based on a previous head.
+
+### Verify and merge
+
+- Use validation results associated with the current head and current base.
+- Check required statuses and additional checks relevant to the update. Wait for
+  downstream jobs, including coverage collation, to finish.
+- Do not count pending, failed, unknown, or unexpectedly skipped checks as
+  successful. Investigate expected skips before describing what was verified.
+- Validate workflow changes with actionlint and zizmor. Compare existing
+  findings with the base, distinguish new findings, and assess their relevance;
+  an unchanged finding count alone is not proof of safety.
+- Do not merge with unresolved review findings or compatibility concerns.
+- Immediately before merging, re-read the open state, head SHA, base, all
+  relevant checks, and `mergeStateStatus: CLEAN`.
+- Merge with the inspected head SHA as an expected-head guard, using the
+  repository's configured merge method. Confirm that GitHub reports success.
+- If the expected head no longer matches, read the new state and review it
+  rather than resending the same merge request. Never bypass protection or use
+  an admin override to complete the batch.
+
+## Skip or stop
+
+Skip an update with a PR-specific problem and continue with independent
+candidates. Return the decision to the user when:
+
+- A public compatibility or support-policy change is needed.
+- CI failures or security concerns cannot be resolved within scope.
+- Unrelated edits are present and their intent cannot be established.
+- Required verification results cannot be obtained.
+
+If authentication or API failures prevent reliable review of the whole batch,
+stop merging. Report completed and uncompleted work separately.
+
+## Integration and resumption
+
+- After each merge, check master CI. If integration fails, stop further merges
+  and report the impact. Determine the cause and authorization before fixing,
+  reverting, or rerunning anything.
+- Verify the final master commit's CI before reporting the batch complete.
+- On resumption, retrieve the current PR state, head, base, and CI results
+  again. Do not rely on the pre-interruption snapshot.
+
+## Completion report
+
+Summarize:
+
+- Each PR's update and its merged, skipped, excluded, or held disposition.
+- Reasons for skips and decisions that require the user's judgment.
+- The final master SHA and CI link.
+- Verification performed and items that remain unverified.
+- Documentation and implementation inconsistencies encountered during the task.
+- A short Keep / Problem / Try retrospective.
+
+Distinguish successful coverage collation from successful delivery to an
+external service, and local test success from CI matrix success.

data/.github/dependabot.yml

@@ -1,11 +1,24 @@
 version: 2
 updates:
 - package-ecosystem: bundler
-  directory: "/"
+  directories:
+  - "/"
+  - "/gemfiles/active_support"
+  groups:
+    shared-dependencies:
+      patterns:
+      - "*"
+      group-by: dependency-name
   schedule:
-    interval: daily
+    interval: weekly
+    day: monday
     time: "08:00"
-    timezone: Japan
+    timezone: Asia/Tokyo
+  cooldown:
+    default-days: 7
+    semver-major-days: 14
+    semver-minor-days: 7
+    semver-patch-days: 3
   open-pull-requests-limit: 10
   reviewers:
   - ryz310
@@ -17,3 +30,19 @@ updates:
   - dependency-name: simplecov
     versions:
     - ">= 0.19.a, < 0.20"
+- package-ecosystem: github-actions
+  directory: "/"
+  schedule:
+    interval: weekly
+    day: monday
+    time: "08:00"
+    timezone: Asia/Tokyo
+  cooldown:
+    default-days: 7
+  open-pull-requests-limit: 10
+  reviewers:
+  - ryz310
+  assignees:
+  - ryz310
+  labels:
+  - dependabot

data/.github/scripts/dependabot-auto-merge.cjs

@@ -0,0 +1,182 @@
+'use strict';
+
+const { evaluate } = require('./dependabot-policy.cjs');
+const workflowPath = '.github/workflows/dependabot-auto-merge.yml';
+const markerPrefix = 'Dependabot auto-merge policy reservation\n\n';
+
+function reservationBody(context) {
+  return markerPrefix + JSON.stringify({
+    version: 1, workflow: workflowPath,
+    repository: `${context.repo.owner}/${context.repo.repo}`,
+    number: context.payload.pull_request.number,
+    head: context.payload.pull_request.head.sha,
+    run: String(context.runId),
+  });
+}
+
+async function readState(github, context) {
+  const result = await github.graphql(`query($owner: String!, $repo: String!, $number: Int!) {
+    repository(owner: $owner, name: $repo) {
+      pullRequest(number: $number) {
+        id state headRefOid baseRefName mergeStateStatus
+        autoMergeRequest { enabledAt enabledBy { login __typename } commitBody mergeMethod }
+      }
+    }
+  }`, { ...context.repo, number: context.payload.pull_request.number });
+  const pr = result.repository && result.repository.pullRequest;
+  if (!pr || !pr.id || !pr.headRefOid || !Object.hasOwn(pr, 'autoMergeRequest')) {
+    throw new Error('Cannot verify current auto-merge state; inspect the PR manually.');
+  }
+  return pr;
+}
+
+function validOwnershipMarker(marker, context) {
+  const matchesWorkflow = marker.version === 1 && marker.workflow === workflowPath;
+  const matchesPullRequest = marker.repository === `${context.repo.owner}/${context.repo.repo}` &&
+    marker.number === context.payload.pull_request.number;
+  const validIdentity = /^[a-f0-9]{40}$/.test(marker.head) && /^[1-9][0-9]*$/.test(marker.run);
+  return matchesWorkflow && matchesPullRequest && validIdentity;
+}
+
+async function ownedReservation(github, context, reservation) {
+  if (!reservation) return false;
+  if (reservation.enabledBy?.login !== 'github-actions[bot]' ||
+      reservation.enabledBy.__typename !== 'Bot' ||
+      !reservation.commitBody?.startsWith(markerPrefix)) return false;
+  let marker;
+  try { marker = JSON.parse(reservation.commitBody.slice(markerPrefix.length)); }
+  catch { return false; }
+  if (!validOwnershipMarker(marker, context)) return false;
+  // GITHUB_TOKEN is shared across workflows: verify the marker's run provenance too.
+  const { data: run } = await github.rest.actions.getWorkflowRun({
+    ...context.repo, run_id: marker.run,
+  });
+  return String(run.id) === marker.run && run.path === workflowPath &&
+    run.event === 'pull_request_target' &&
+    run.repository?.full_name === marker.repository;
+}
+
+function sameReservation(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+
+async function revoke({ github, context, core, state }) {
+  if (!state.autoMergeRequest) return;
+  if (!await ownedReservation(github, context, state.autoMergeRequest)) {
+    core.notice('Preserving an unowned or legacy auto-merge reservation. Inspect it manually before merging.');
+    return;
+  }
+  // No conditional-disable mutation exists. Serialize this workflow's runs and
+  // re-read immediately before mutation; external writers must not race recovery.
+  const current = await readState(github, context);
+  if (!current.autoMergeRequest) return;
+  if (current.headRefOid !== context.payload.pull_request.head.sha ||
+      !sameReservation(current.autoMergeRequest, state.autoMergeRequest)) {
+    throw new Error('PR head or reservation changed before cancellation; inspect auto-merge manually.');
+  }
+  await github.graphql(`mutation($id: ID!) {
+    disablePullRequestAutoMerge(input: {pullRequestId: $id}) {
+      pullRequest { id autoMergeRequest { enabledAt } }
+    }
+  }`, { id: current.id });
+  const after = await readState(github, context);
+  if (after.autoMergeRequest) {
+    throw new Error('Auto-merge cancellation was not confirmed; disable auto-merge manually.');
+  }
+  core.notice('Revoked this workflow\'s auto-merge reservation.');
+}
+
+function cleanStatusError(error) {
+  // Octokit preserves the structured GraphQL errors separately from Error.message.
+  if (error.name !== 'GraphqlResponseError' || !Array.isArray(error.errors) ||
+      error.errors.length !== 1) return false;
+  const failure = error.errors[0];
+  return failure.type === 'UNPROCESSABLE' &&
+    JSON.stringify(failure.path) === JSON.stringify(['enablePullRequestAutoMerge']) &&
+    failure.message === 'Pull request Pull request is in clean status';
+}
+
+async function mergeCleanUpdate({ github, context, core, metadata }) {
+  // Repeat the entire policy/protection check; the PR base can change without a
+  // new head OID. A fresh final snapshot also preserves newly created reservations.
+  if (!await evaluate({ github, context, core, metadata })) {
+    throw new Error('Policy changed after the clean-status response; inspect the PR manually.');
+  }
+  const current = await readState(github, context);
+  const sameTarget = current.headRefOid === context.payload.pull_request.head.sha &&
+    current.baseRefName === 'master';
+  const ready = current.state === 'OPEN' && current.mergeStateStatus === 'CLEAN';
+  if (!sameTarget || !ready || current.autoMergeRequest) {
+    throw new Error('PR state changed before the clean-status merge; inspect the PR manually.');
+  }
+  const result = await github.graphql(`mutation($id: ID!, $head: GitObjectID!) {
+    mergePullRequest(input: {pullRequestId: $id, expectedHeadOid: $head, mergeMethod: MERGE}) {
+      pullRequest { id headRefOid merged }
+    }
+  }`, { id: current.id, head: current.headRefOid });
+  const merged = result.mergePullRequest?.pullRequest;
+  if (merged?.merged !== true || merged.headRefOid !== current.headRefOid) {
+    throw new Error('Could not confirm the clean-status merge; inspect the PR manually.');
+  }
+  core.notice('Merged the inspected head after all required checks passed.');
+}
+
+async function reconcileState({ github, context, core, metadata, metadataOutcome }) {
+  const state = await readState(github, context);
+  if (state.headRefOid !== context.payload.pull_request.head.sha) {
+    core.notice('Stale event: preserving the current head\'s auto-merge state.');
+    return;
+  }
+  let safe = false;
+  let verificationError;
+  try {
+    if (metadataOutcome !== 'success') throw new Error('Dependabot metadata retrieval failed.');
+    safe = await evaluate({ github, context, core, metadata });
+  } catch (error) { verificationError = error; }
+
+  if (!safe) {
+    await revoke({ github, context, core, state });
+    if (verificationError) {
+      throw new Error(`Policy verification failed; check the PR's auto-merge state: ${verificationError.message}`);
+    }
+    core.notice('Update requires manual review.');
+    return;
+  }
+
+  const current = await readState(github, context);
+  if (current.headRefOid !== context.payload.pull_request.head.sha || current.state !== 'OPEN') {
+    core.notice('PR changed during verification; no reservation created.');
+    return;
+  }
+  if (current.autoMergeRequest) {
+    core.notice('Preserving the existing auto-merge reservation.');
+    return;
+  }
+  let result;
+  try {
+    result = await github.graphql(`mutation($id: ID!, $head: GitObjectID!, $body: String!) {
+      enablePullRequestAutoMerge(input: {
+        pullRequestId: $id, expectedHeadOid: $head, mergeMethod: MERGE, commitBody: $body
+      }) { pullRequest { id headRefOid autoMergeRequest { commitBody } } }
+    }`, { id: current.id, head: current.headRefOid, body: reservationBody(context) });
+  } catch (error) {
+    if (!cleanStatusError(error)) throw error;
+    await mergeCleanUpdate({ github, context, core, metadata });
+    return;
+  }
+  const enabled = result.enablePullRequestAutoMerge?.pullRequest;
+  if (enabled?.headRefOid !== current.headRefOid ||
+      enabled.autoMergeRequest?.commitBody !== reservationBody(context)) {
+    throw new Error('Could not verify the new reservation; inspect auto-merge manually.');
+  }
+  core.notice('Reserved auto-merge for the inspected head.');
+}
+
+async function reconcile(input) {
+  try { await reconcileState(input); }
+  catch (error) {
+    throw new Error(`Auto-merge reconciliation failed; inspect the PR and disable an unsafe reservation manually: ${error.message}`);
+  }
+}
+
+module.exports = { reconcile, reservationBody, ownedReservation };

data/.github/scripts/dependabot-auto-merge.test.cjs

@@ -0,0 +1,278 @@
+'use strict';
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const { reconcile, reservationBody, ownedReservation } = require('./dependabot-auto-merge.cjs');
+const { requiredChecks } = require('./dependabot-policy.cjs');
+
+function harness() {
+  const context = { repo: { owner: 'ryz310', repo: 'redis-objects-periodical' }, runId: 123,
+    payload: { pull_request: { number: 1, head: { sha: 'a'.repeat(40) } } } };
+  const reservation = { enabledAt: '2026-10-27T00:00:00Z',
+    enabledBy: { login: 'github-actions[bot]', __typename: 'Bot' },
+    commitBody: reservationBody(context), mergeMethod: 'MERGE' };
+  const state = { id: 'PR_node', state: 'OPEN', headRefOid: 'a'.repeat(40),
+    baseRefName: 'master', mergeStateStatus: 'BLOCKED', autoMergeRequest: reservation };
+  const calls = [], notices = [], states = [];
+  const pr = { number: 1, user: { login: 'dependabot[bot]' }, state: 'open', draft: false,
+    base: { ref: 'master', sha: 'base', repo: { full_name: 'ryz310/redis-objects-periodical' } },
+    head: { sha: state.headRefOid, repo: { full_name: 'ryz310/redis-objects-periodical' } }, changed_files: 1 };
+  const run = { id: 123, path: '.github/workflows/dependabot-auto-merge.yml',
+    event: 'pull_request_target', repository: { full_name: 'ryz310/redis-objects-periodical' } };
+  const github = {
+    rest: { pulls: { get: async () => ({ data: pr }), listFiles: 'files' },
+      actions: { getWorkflowRun: async () => ({ data: run }) } },
+    paginate: async endpoint => endpoint === 'files' ? [{ filename: '.github/workflows/ci.yml', status: 'modified',
+      additions: 1, deletions: 1, patch: '@@ -1 +1 @@\n-  uses: actions/checkout@' + 'a'.repeat(40) +
+        '\n+  uses: actions/checkout@' + 'b'.repeat(40) }] : [],
+    graphql: async (query, variables) => {
+      if (query.includes('mergePullRequest')) {
+        assert.match(query, /expectedHeadOid: \$head, mergeMethod: MERGE/);
+        calls.push(['merge', variables]); state.state = 'MERGED';
+        return { mergePullRequest: { pullRequest: { ...state, merged: true } } };
+      }
+      if (query.includes('disablePullRequestAutoMerge')) {
+        calls.push(['disable', variables]); state.autoMergeRequest = null;
+        return { disablePullRequestAutoMerge: { pullRequest: state } };
+      }
+      if (query.includes('enablePullRequestAutoMerge')) {
+        calls.push(['enable', variables]);
+        state.autoMergeRequest = { ...reservation, commitBody: variables.body };
+        return { enablePullRequestAutoMerge: { pullRequest: state } };
+      }
+      if (query.includes('autoMergeRequest')) return { repository: { pullRequest: states.shift() || structuredClone(state) } };
+      return { repository: { autoMergeAllowed: true, ref: { branchProtectionRule: {
+        requiresStatusChecks: true, requiresStrictStatusChecks: true, requiredStatusCheckContexts: requiredChecks,
+      } } } };
+    },
+  };
+  return { github, context, core: { notice: message => notices.push(message) },
+    metadata: { ecosystem: 'github_actions', updateType: 'version-update:semver-major', dependencyNames: 'actions/checkout' },
+    metadataOutcome: 'success', state, reservation, states, pr, run, calls, notices };
+}
+
+test('revokes an owned reservation when the current-head update is rejected', async () => {
+  const input = harness(); await reconcile(input);
+  assert.deepEqual(input.calls, [['disable', { id: 'PR_node' }]]);
+  assert.equal(input.state.autoMergeRequest, null);
+});
+for (const scenario of ['no-reservation', 'already-disabled']) {
+  test(`rejection tolerates ${scenario}`, async () => {
+    const input = harness();
+    if (scenario === 'no-reservation') input.state.autoMergeRequest = null;
+    else input.states.push(structuredClone(input.state), { ...input.state, autoMergeRequest: null });
+    await reconcile(input); assert.deepEqual(input.calls, []);
+  });
+}
+for (const scenario of ['human', 'other-workflow', 'legacy', 'wrong-repo', 'wrong-pr', 'malformed', 'wrong-event', 'wrong-run']) {
+  test(`preserves ${scenario} reservations`, async () => {
+    const input = harness();
+    if (scenario === 'human') input.reservation.enabledBy = { login: 'maintainer', __typename: 'User' };
+    if (scenario === 'other-workflow') input.run.path = '.github/workflows/another.yml';
+    if (scenario === 'legacy') input.reservation.commitBody = 'Existing merge message';
+    if (scenario === 'wrong-repo') input.reservation.commitBody = reservationBody({ ...input.context, repo: { owner: 'other', repo: 'repo' } });
+    if (scenario === 'wrong-pr') input.reservation.commitBody = reservationBody({ ...input.context,
+      payload: { pull_request: { number: 2, head: { sha: 'a'.repeat(40) } } } });
+    if (scenario === 'malformed') input.reservation.commitBody = 'Dependabot auto-merge policy reservation\n\n{';
+    if (scenario === 'wrong-event') input.run.event = 'push';
+    if (scenario === 'wrong-run') input.run.id = 124;
+    await reconcile(input); assert.deepEqual(input.calls, []);
+    assert.ok(input.notices.some(message => message.includes('Inspect it manually')));
+  });
+}
+for (const scenario of ['metadata', 'evaluation']) {
+  test(`revokes on ${scenario} failure and still fails visibly`, async () => {
+    const input = harness();
+    if (scenario === 'metadata') input.metadataOutcome = 'failure';
+    else input.github.paginate = async () => { throw new Error('API unavailable'); };
+    await assert.rejects(reconcile(input), /Policy verification failed/);
+    assert.equal(input.calls[0][0], 'disable');
+  });
+}
+test('stale events preserve a newer successfully evaluated reservation', async () => {
+  const input = harness(); input.state.headRefOid = 'b'.repeat(40);
+  input.state.autoMergeRequest.commitBody = reservationBody({ ...input.context,
+    payload: { pull_request: { number: 1, head: { sha: 'b'.repeat(40) } } } });
+  input.github.paginate = async () => { throw new Error('Must not evaluate stale event'); };
+  await reconcile(input); assert.deepEqual(input.calls, []);
+});
+for (const scenario of ['head', 'reservation']) {
+  test(`refuses to cancel after concurrent ${scenario} change`, async () => {
+    const input = harness(); const changed = structuredClone(input.state);
+    if (scenario === 'head') changed.headRefOid = 'b'.repeat(40);
+    else changed.autoMergeRequest.enabledAt = '2026-10-27T01:00:00Z';
+    input.states.push(structuredClone(input.state), changed);
+    await assert.rejects(reconcile(input), /changed before cancellation/);
+    assert.deepEqual(input.calls, []);
+  });
+}
+for (const scenario of ['cancellation-error', 'cancellation-unconfirmed', 'provenance-error', 'initial-read-error', 'verification-read-error']) {
+  test(`fails visibly on ${scenario}`, async () => {
+    const input = harness(); const graphql = input.github.graphql;
+    if (scenario === 'provenance-error') input.github.rest.actions.getWorkflowRun = async () => { throw new Error('Forbidden'); };
+    else input.github.graphql = async (query, variables) => {
+      if (scenario === 'cancellation-error' && query.includes('disablePullRequestAutoMerge')) throw new Error('Forbidden');
+      if (scenario === 'cancellation-unconfirmed' && query.includes('disablePullRequestAutoMerge')) return {};
+      if (scenario === 'initial-read-error') throw new Error('Forbidden');
+      if (scenario === 'verification-read-error' && input.calls.length) throw new Error('Forbidden');
+      return graphql(query, variables);
+    };
+    await assert.rejects(reconcile(input), /Forbidden|cancellation was not confirmed/);
+  });
+}
+test('safe updates reserve with an atomic expected-head guard and ownership body', async () => {
+  const input = harness(); input.state.autoMergeRequest = null;
+  input.metadata.updateType = 'version-update:semver-patch';
+  await reconcile(input);
+  assert.deepEqual(input.calls, [['enable', { id: 'PR_node', head: 'a'.repeat(40), body: reservationBody(input.context) }]]);
+});
+test('safe updates preserve existing reservations including human-owned ones', async () => {
+  const input = harness(); input.metadata.updateType = 'version-update:semver-patch';
+  input.reservation.enabledBy = { login: 'maintainer', __typename: 'User' };
+  await reconcile(input); assert.deepEqual(input.calls, []);
+});
+test('head change during a successful evaluation cannot enable a reservation', async () => {
+  const input = harness(); input.state.autoMergeRequest = null;
+  input.metadata.updateType = 'version-update:semver-patch';
+  input.states.push(structuredClone(input.state), { ...input.state, headRefOid: 'b'.repeat(40) });
+  await reconcile(input); assert.deepEqual(input.calls, []);
+});
+test('ownership requires workflow run provenance beyond the shared bot identity', async () => {
+  const input = harness();
+  assert.equal(await ownedReservation(input.github, input.context, input.reservation), true);
+  input.run.repository.full_name = 'other/repo';
+  assert.equal(await ownedReservation(input.github, input.context, input.reservation), false);
+});
+
+for (const scenario of ['enable-error', 'null-response', 'missing-reservation', 'wrong-head']) {
+  test(`fails visibly on ${scenario} after an eligible evaluation`, async () => {
+    const input = harness(); input.state.autoMergeRequest = null;
+    input.metadata.updateType = 'version-update:semver-patch';
+    const graphql = input.github.graphql;
+    input.github.graphql = async (query, variables) => {
+      if (!query.includes('enablePullRequestAutoMerge')) return graphql(query, variables);
+      if (scenario === 'enable-error') throw new Error('Forbidden');
+      if (scenario === 'null-response') return { enablePullRequestAutoMerge: null };
+      if (scenario === 'missing-reservation') return { enablePullRequestAutoMerge: { pullRequest: input.state } };
+      return { enablePullRequestAutoMerge: { pullRequest: { ...input.state,
+        headRefOid: 'b'.repeat(40), autoMergeRequest: input.reservation } } };
+    };
+    await assert.rejects(reconcile(input), /inspect the PR.*(?:Forbidden|Could not verify)/);
+  });
+}
+
+test('metadata retrieval failure still fails when no reservation exists', async () => {
+  const input = harness(); input.state.autoMergeRequest = null; input.metadataOutcome = 'failure';
+  await assert.rejects(reconcile(input), /metadata retrieval failed/);
+  assert.deepEqual(input.calls, []);
+});
+
+test('privileged workflow keeps trusted-base execution and failure cleanup wired', () => {
+  const { readFileSync } = require('node:fs');
+  const { join } = require('node:path');
+  const workflow = readFileSync(join(__dirname, '../workflows/dependabot-auto-merge.yml'), 'utf8');
+  assert.match(workflow, /cancel-in-progress: false/);
+  assert.match(workflow, /ref: \$\{\{ github.event.pull_request.base.sha \}\}/);
+  assert.doesNotMatch(workflow, /ref:.*pull_request.head/);
+  assert.match(workflow, /if: \$\{\{ always\(\) && steps.policy_checkout.outcome == 'success' \}\}/);
+  assert.match(workflow, /METADATA_OUTCOME: \$\{\{ steps.metadata.outcome \}\}/);
+  assert.match(workflow, /await reconcile\(/);
+});
+
+
+// Reproduce the reviewer-observed clean-status response in Octokit's structured
+// GraphqlResponseError shape; no live merge or reservation is used by these tests.
+function cleanStatusFailure() {
+  const failure = new Error('Request failed due to following response errors:\n - Pull request Pull request is in clean status');
+  failure.name = 'GraphqlResponseError';
+  failure.errors = [{ type: 'UNPROCESSABLE', path: ['enablePullRequestAutoMerge'],
+    message: 'Pull request Pull request is in clean status' }];
+  return failure;
+}
+
+function cleanHarness(failure = cleanStatusFailure(), afterEnable = () => {}) {
+  const input = harness(); input.state.autoMergeRequest = null;
+  input.state.mergeStateStatus = 'CLEAN';
+  input.metadata.updateType = 'version-update:semver-patch';
+  const graphql = input.github.graphql;
+  input.github.graphql = async (query, variables) => {
+    if (query.includes('enablePullRequestAutoMerge')) {
+      input.calls.push(['enable', variables]);
+      afterEnable(input);
+      throw failure;
+    }
+    return graphql(query, variables);
+  };
+  return input;
+}
+
+test('an eligible PR with passing checks falls back to a guarded merge after the exact clean-status error', async () => {
+  const input = cleanHarness(); let protectionReads = 0;
+  const paginate = input.github.paginate;
+  input.github.paginate = async (endpoint, variables) => {
+    if (endpoint !== 'files') protectionReads++;
+    return paginate(endpoint, variables);
+  };
+  await reconcile(input);
+  assert.equal(protectionReads, 2, 'Verify protection again immediately before the merge');
+  assert.deepEqual(input.calls.map(call => call[0]), ['enable', 'merge']);
+  assert.deepEqual(input.calls[1][1], { id: 'PR_node', head: 'a'.repeat(40) });
+  assert.ok(input.notices.some(message => message.startsWith('Merged the inspected head')));
+});
+
+for (const scenario of ['plain-message', 'forbidden', 'network', 'wrong-mutation', 'wrong-type', 'unknown-message', 'mixed-errors']) {
+  test(`clean-status fallback does not accept ${scenario}`, async () => {
+    let failure = cleanStatusFailure();
+    if (scenario === 'plain-message') failure = new Error(failure.errors[0].message);
+    if (scenario === 'forbidden') failure.errors[0].type = 'FORBIDDEN';
+    if (scenario === 'network') failure.name = 'HttpError';
+    if (scenario === 'wrong-mutation') failure.errors[0].path = ['mergePullRequest'];
+    if (scenario === 'wrong-type') failure.errors[0].type = 'NOT_FOUND';
+    if (scenario === 'unknown-message') failure.errors[0].message = 'Unknown clean-status error';
+    if (scenario === 'mixed-errors') failure.errors.push({ type: 'FORBIDDEN', message: 'Forbidden' });
+    const input = cleanHarness(failure);
+    await assert.rejects(reconcile(input), /Auto-merge reconciliation failed/);
+    assert.deepEqual(input.calls.map(call => call[0]), ['enable']);
+  });
+}
+
+for (const scenario of ['head', 'base', 'closed', 'blocked', 'unknown-status', 'new-human-reservation', 'protection']) {
+  test(`clean-status fallback refuses a changed ${scenario}`, async () => {
+    const input = cleanHarness(cleanStatusFailure(), current => {
+      if (scenario === 'head') current.state.headRefOid = 'b'.repeat(40);
+      if (scenario === 'base') current.state.baseRefName = 'release';
+      if (scenario === 'closed') current.state.state = 'CLOSED';
+      if (scenario === 'blocked') current.state.mergeStateStatus = 'BLOCKED';
+      if (scenario === 'unknown-status') current.state.mergeStateStatus = 'UNKNOWN';
+      if (scenario === 'new-human-reservation') current.state.autoMergeRequest = {
+        ...current.reservation, enabledBy: { login: 'maintainer', __typename: 'User' },
+      };
+      if (scenario === 'protection') {
+        const graphql = current.github.graphql;
+        current.github.graphql = async (query, variables) => query.includes('autoMergeAllowed') ?
+          { repository: { autoMergeAllowed: false } } : graphql(query, variables);
+      }
+    });
+    await assert.rejects(reconcile(input), /Policy changed|PR state changed/);
+    assert.deepEqual(input.calls.map(call => call[0]), ['enable']);
+  });
+}
+
+test('retargeting during clean-status fallback is rejected by the repeated policy evaluation', async () => {
+  const input = cleanHarness(cleanStatusFailure(), current => { current.pr.base.ref = 'release'; });
+  await assert.rejects(reconcile(input), /Policy changed/);
+  assert.deepEqual(input.calls.map(call => call[0]), ['enable']);
+});
+
+for (const scenario of ['api-error', 'not-merged', 'wrong-head', 'missing-response']) {
+  test(`clean-status merge fails visibly on ${scenario}`, async () => {
+    const input = cleanHarness(); const graphql = input.github.graphql;
+    input.github.graphql = async (query, variables) => {
+      if (!query.includes('mergePullRequest')) return graphql(query, variables);
+      if (scenario === 'api-error') throw new Error('Head or protection changed');
+      if (scenario === 'missing-response') return { mergePullRequest: null };
+      return { mergePullRequest: { pullRequest: { merged: scenario !== 'not-merged',
+        headRefOid: scenario === 'wrong-head' ? 'b'.repeat(40) : input.state.headRefOid } } };
+    };
+    await assert.rejects(reconcile(input), /Head or protection changed|Could not confirm/);
+  });
+}