fix(ci): require reviewed Dependabot merges and refresh tooling

[acgetchell]

• Gate squash merges on exact-head CodeRabbit approval and required checks.
• Group GitHub Actions, uv, and vcpkg updates into weekly batches.
• Refresh the pinned build, packaging, analysis, and workflow toolchain.

Summary by CodeRabbit

• Documentation

  • Updated build instructions to use CMake 4.4.1 while retaining the existing minimum requirement.
  • Refreshed documented development tool versions for more consistent setup and checks.

• Chores

  • Updated automated code analysis and build tooling.
  • Improved automated update handling by adding scheduled update coverage and safer approval and merge checks.
  • Refined review automation to reduce unnecessary progress notifications.

[coderabbitai]

Walkthrough

The PR updates Dependabot automation, CodeRabbit review configuration, GitHub Action pins, and development toolchain versions. It also aligns CMake references across workflow recipes, documentation, and the Slurm build script.

Changes

Maintenance updates

Layer / File(s)	Summary
Dependency update policy .github/dependabot.yml	Dependabot adds weekly uv and vcpkg updates with cooldowns, pull request limits, and grouped updates.
Approval-gated Dependabot merge .coderabbit.yaml, .github/workflows/dependabot-auto-merge.yml	The workflow verifies CodeRabbit approval for the current pull request head, waits for required checks, and squash-merges the approved SHA.
CI and development toolchain refresh .github/actions/setup-just/action.yml, .github/workflows/codeql.yml, Justfile, README.md, pyproject.toml, scripts/slurm.sh	Pinned action, build tool, backend, lint tool, type tool, and CMake versions are updated.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Dependabot
  participant AutoMergeWorkflow
  participant CodeRabbit
  participant RequiredChecks
  participant GitHub
  Dependabot->>AutoMergeWorkflow: Open dependency pull request
  AutoMergeWorkflow->>CodeRabbit: Check approval for current head
  CodeRabbit-->>AutoMergeWorkflow: Return approval and approved SHA
  AutoMergeWorkflow->>RequiredChecks: Wait for required checks
  RequiredChecks-->>AutoMergeWorkflow: Return check results
  AutoMergeWorkflow->>GitHub: Squash-merge approved SHA

Loading

Possibly related issues

• acgetchell/causal-triangulations#216 — Covers the same CodeRabbit-approved Dependabot auto-merge workflow.
• acgetchell/markov-chain-monte-carlo#111 — Covers CodeRabbit approval and protected-check gating for Dependabot merges.
• acgetchell/mcmc-learned-proposals#1 — Covers related Dependabot configuration and CodeRabbit-gated merge automation.

Possibly related PRs

• acgetchell/CDT-plusplus#133 — Modifies the same Dependabot and CodeRabbit automation files.
• acgetchell/CDT-plusplus#134 — Updates the same CodeQL action references.
• acgetchell/CDT-plusplus#135 — Modifies the same Dependabot auto-merge workflow.

Suggested labels: dependencies, github_actions

Poem

Pins align and checks now flow,
Dependabot waits before merge.
CodeRabbit guards each commit,
CMake tools advance in step.
Clean updates cross the forge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main CI change and the tooling refresh described in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dependabot-coderabbit-workflow-hardening

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/dependabot-auto-merge.yml:
- Around line 80-87: Enable strict Bash error handling in the approval polling
step by adding set -euo pipefail immediately before the while true loop. Ensure
failures from gh api or the jq pipeline propagate and terminate the loop instead
of allowing polling to continue until timeout.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: df316a69-ab0b-4fdb-99cd-e0bce6539d3d

📥 Commits

Reviewing files that changed from the base of the PR and between 90a3ea6 and 7c3a84b.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (11)

• .coderabbit.yaml
• .github/actions/setup-just/action.yml
• .github/dependabot.yml
• .github/workflows/codeql.yml
• .github/workflows/dependabot-auto-merge.yml
• Justfile
• README.md
• pyproject.toml
• scripts/pkgx-build.sh
• scripts/pkgx-env.sh
• scripts/slurm.sh

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/dependabot-auto-merge.yml (1)

98-110: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Re-check the CodeRabbit approval before merging.

After required checks succeed, confirm that the current head equals APPROVED_HEAD_SHA and that the latest coderabbitai[bot] review for that head remains APPROVED. Keep --match-head-commit as the final head guard.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/dependabot-auto-merge.yml around lines 98 - 110, Update
the workflow between “Wait for required checks” and “Squash approved PR head” to
re-fetch the current PR head and verify it equals APPROVED_HEAD_SHA, then
confirm the latest coderabbitai[bot] review for that head is still APPROVED
before merging. Preserve gh pr merge’s --match-head-commit "$APPROVED_HEAD_SHA"
guard as the final protection.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/dependabot-auto-merge.yml:
- Around line 98-110: Update the workflow between “Wait for required checks” and
“Squash approved PR head” to re-fetch the current PR head and verify it equals
APPROVED_HEAD_SHA, then confirm the latest coderabbitai[bot] review for that
head is still APPROVED before merging. Preserve gh pr merge’s
--match-head-commit "$APPROVED_HEAD_SHA" guard as the final protection.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: bcf1b69c-990f-4f79-ae54-4c0baf4691ff

📥 Commits

Reviewing files that changed from the base of the PR and between 7c3a84b and 1d2e667.

📒 Files selected for processing (2)

• .github/workflows/dependabot-auto-merge.yml
• Justfile