[loks0n]

Replaces this repo's dependabot-auto-merge.yml with a call to the shared workflow from appwrite/.github#132, pinned to its merge commit.

The shared gate runs after each workflow a PR triggers, from the default branch, so a PR can't change it. For a Dependabot patch or minor update it waits for every workflow run, check run and commit status on the exact head SHA, approves when all of them pass, and merges with --match-head-commit. Majors and failures stay for a human. Because it merges directly, the repo doesn't need Allow auto-merge or required status checks.

Adds cooldown: default-days: 7 to every update entry, matching appwrite/appwrite, so a release is a week old before Dependabot proposes it. That gives a compromised release time to get yanked before it's auto-merged. Security updates ignore cooldown.

Part of fixing Dependabot auto-merge across both orgs: 0 bot merges in 30 days, 266 open PRs.

🤖 Generated with Claude Code

[hansi-codes]

🟢 Tier S · Ready to merge

The added permission resolves the outstanding workflow-run access gap, and I found no new issues in this incremental change.

The workflow delegates Dependabot patch and minor update approval and merging to the pinned shared gate after CI completes. Dependabot npm and GitHub Actions updates use a seven-day default cooldown, and the gate now has Actions read permission to inspect workflow runs.

Latest changes: The new commit grants the shared gate Actions read permission so it can enumerate workflow runs for the Dependabot commit.

Verdict	New comments	Fixed	Still open
✅ Approved	0	1	0

📂 Walkthrough · 2

File	Change
.github/dependabot.yml	Adds a seven-day default cooldown for npm and GitHub Actions updates.
.github/workflows/dependabot-auto-merge.yml	Delegates Dependabot patch and minor auto-merge to the pinned shared workflow and grants read access to Actions, checks, and statuses plus write access to contents and pull requests.

✅ Fixed since the last review · 1

• Grant Actions read permission to the shared gate · .github/workflows/dependabot-auto-merge.yml:13

---

_{Reviewed the commits since d7bb29b · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟡 Tier B · 1 blocking finding to address. Summary

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary