[codeforester]

Summary

• allow GitHub Dependabot update branches through the issue-branch policy
• require the pull request author to be dependabot[bot]
• require the Dependabot head repository to be this repository
• preserve the canonical issue-backed branch policy for all other pull requests

Why

The required base/issue-branch-policy check currently rejects every open Dependabot update because generated dependabot/* branches cannot encode an issue number. This blocks routine dependency and action updates even when all functional checks pass.

This is a narrow prerequisite for the v1.0 security/dependency stabilization work tracked by #490. It does not relax the policy for human branches or fork-owned branches.

Validation

• workflow YAML parses successfully
• git diff --check passes
• the trusted-bot and same-repository checks are evaluated before the canonical branch path

Relates to #490.

[codeforester]

Security (real gap): the Dependabot bypass trusts .user.login (the PR's original opener, fixed for the PR's lifetime) instead of verifying the current head commit was actually produced by Dependabot — it authenticates the PR, not the commit. A Dependabot PR is opened (author_login=dependabot[bot], same-repo, dependabot/* branch name) and passes this check; if any repo collaborator with push access later pushes an arbitrary commit onto that same branch, the synchronize event re-runs this function with the new head SHA, but author_login/head_repo_full_name/the branch-name prefix are all unchanged, so it still returns success — completely bypassing the category/calendar-date/issue-existence checks enforced for every other branch, for content Dependabot never produced.

[codeforester]

Test gap: no automated test exercises this new Dependabot-bypass branch. tests/validate.sh only checks that the workflow file exists, not that its logic behaves correctly — a later refactor that weakens the author_login/head_repo_full_name/branch_name triple check (e.g. to just branch_name == dependabot/*) would ship without any test catching the widened trust gap.