[denniyahh]

• .github/dependabot.yml: one grouped weekly PR against develop for the GitHub Actions the workflows use. There are no Cargo version-update PRs: each would run the full container CI, and cargo deny already covers advisories. The pinned devcontainer image stays hand-bumped, because three files must match.
• .github/workflows/scheduled-deps.yml: runs scripts/check.sh deps every Monday and on demand, so a new RustSec advisory surfaces without a push. GitHub runs scheduled workflows only from the default branch, which is now develop, so this takes effect when it merges.
• ci_parity_guards: the scheduled workflow must run the devcontainer's pinned image and check.sh deps, and the guard fails on a drifted tag.

Automatic Dependabot security-fix PRs stay off.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RGzZZbfn3r9638yptqPL47

[graphify-labs]

Graphify reviewed this change.

Code graph out of date: Health delta baseline: last indexed commit 71a5192 (diverged from this PR's base — delta is approximate). Health delta baseline was built by an older engine whose node ids do not match this review's — delta is approximate. Impact and hotspot numbers below may be wrong.

No verdict: the code graph is out of date. Static checks found no blocking issues, but they compared against an outdated graph. The next push after the repository re-indexes gets a full review.

Not checked: tests were not run; no formal proof of the changed code.

---

Graphify review — findings

Adds a weekly Scheduled dependency checks workflow that runs scripts/check.sh deps in the pinned devcontainer image, so a new RustSec advisory against an untouched dependency still turns something red. It can also be triggered on demand via workflow_dispatch; GitHub only runs the schedule from main, so it starts firing once a release carries it there. Adds a parity test, scheduled_deps_workflow_runs_the_pinned_image, that requires the workflow to use exactly the image declared in devcontainer.json, run scripts/check.sh deps, and have a schedule: trigger. Without it, an image bump in the devcontainer and ci.yml would leave this workflow silently on the old one. Adds a Dependabot config that opens one grouped weekly PR against develop for GitHub Actions only. Cargo dependencies and the pinned image are deliberately excluded, since advisories are already covered by cargo deny and the image must be bumped by hand in all three files together.

No blocking issues surfaced. 1 lower-confidence candidate did not survive cross-model review.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 38 functions depend on the 38 functions this change touches.

Health — grade A; no new coupling hotspots.

Verification — 38 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit 71a5192 (diverged from this PR's base — delta is approximate).

Health delta baseline was built by an older engine whose node ids do not match this review's — delta is approximate.

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 38 function(s) in the blast radius were not formally verified this run