chore(deps): update dependency edbfi/automation to v4 - autoclosed

[renovate]

This PR contains the following updates:

Package	Update	Change
edbfi/automation	major	v3.0.1 → v4.0.0

---

Release Notes

edbfi/automation (edbfi/automation)

v4.0.0: — GitHub auto-merge, no repair dispatch

Compare Source

v4 replaces the repair-dispatch and recovery machinery with the ordinary GitHub flow: Renovate arms GitHub auto-merge, and GitHub merges only when every required check passes on an up-to-date branch.

Breaking changes

• Merging: automerge.json now arms GitHub auto-merge (platformAutomerge: true, rebase, ignoreTests: false) and has no wildcard rule, so default.json's manual renovate-config rule and repo opt-outs apply. default.json keeps automerge: false and no longer sets the merge mechanism. Consumers need Allow auto-merge enabled.
• Biome repair no longer dispatches CI. The App-authored push starts the normal pull_request CI and policy runs. The ci-workflow input and the caller's actions: write are gone.
• Removed: actions/dispatch-guard, actions/ci-recovery, the repair-recovery workflow and .github/repair-policy.json, and the unused go, rust and content workflows. The pr-number, expected-head-sha and expected-default-sha dispatch inputs and the guard check go with them.
• PR policy re-runs the other trigger event's older failed verdict for the same head after a pass, so a withdrawn objection clears without a manual re-run. Failing runs never re-run anything, newer failures are kept, and attempts are bounded. The caller must grant actions: write.

Also new

• scripts/fleet_audit.py: a read-only audit that exits 0 only when every declared repository meets this contract or has an explicit exception in scripts/fleet.json.

Evidence

• Pilot (edbfi/guides, v3 code with GitHub auto-merge): auto-merge refused to merge on a failed, skipped, cancelled, pending or missing required check. It also held on a head changed after green, a branch behind main, a hold added while CI was pending, and an outstanding review request or changes-requested review. Real Renovate PRs merged 76 s and 5 s after going green; the previous median was 219 min. See edbfi/guides#58.
• Canary (disposable edbfi/v4-canary, this release's code): the consumer migrated from the v3 contract with the checklist below. Renovate PRs auto-merged 7–28 s after going green. A Biome repair published without dispatching anything: the repaired head got one ordinary pull_request CI run and one policy run, and the repo recorded 0 workflow_dispatch runs. An objection withdrawn through a review event cleared by itself 32 s after dismissal. A Renovate PR with failing CI stayed open with auto-merge armed. See #​62.

Migrating to v4

Per repository:

1. Move every edbfi/automation reference to the v4 tag.
2. Delete the guard job, its needs edges, the dispatch-guard step in
   required, and guard in the gate's needs and required:. Remove the
   pr-number, expected-head-sha and expected-default-sha dispatch inputs
   from every workflow. Before merging, remove guard from the branch's required
   checks and keep every other check and its GitHub Actions binding.
3. Delete .github/workflows/repair-recovery.yml and .github/repair-policy.json.
   Drop ci-workflow and actions: write from the Biome repair caller.
4. Replace inline automerge keys with automerge.json, only if the repository
   is eligible. Otherwise remove every automerge: true, cancel any armed GitHub
   auto-merge, and keep automerge off.
5. Grant actions: write in the policy wrapper, so policy can re-run its own stale
   failed run after a pass.
6. For platform automerge, enable Allow auto-merge in the repository settings.

scripts/fleet_audit.py exits 0 only when every declared repository is on the
current contract or has an explicit exception in scripts/fleet.json.

v3.1.0: — DCO prek hooks

Compare Source

Add prek hooks that apply the ci / policy DCO rule locally. They are published through .pre-commit-hooks.yaml:

• dco-signoff (prepare-commit-msg) appends the author-matching Signed-off-by trailer. It runs even with --no-verify, never duplicates the trailer and keeps other sign-offs.
• dco-check (commit-msg) rejects a message whose final paragraph lacks the trailer.
• dco-push-check (pre-push) refuses to push commits without their author's trailer. This covers direct administrator pushes, which ci / policy never sees.

The rule mirrors actions/pr-policy exactly; the tests assert parity. Consumer configuration, the repair recipe and merge-method guidance are in docs/dco.md. List the hook stages in default_install_hook_types: a plain prek install installs only pre-commit.

Protection guidance changed: do not enforce required checks for administrators, so the owner keeps an emergency bypass. Renovate and other integrations must never get one.

Also since v3.0.1: the reusable pr-policy, biome-repair and CI jobs run on ubuntu-26.04, and python.yml and repair recovery use setup-uv v10.2.0. Released internal action references resolve to this tag. Existing published tags are unchanged.

Validation: 93 Python tests (18 new hook tests using real git hooks, re-run under dash, plus mutation checks); Renovate and workflow scripts; actionlint; full merged-head CI https://github.com/edbfi/automation/actions/runs/35971945278.

Change: #​61
Commit: a996797

---

Configuration

📅 Schedule: (in timezone Europe/Copenhagen)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.