ci(dependabot): gate auto-merge on CodeRabbit approval

[acgetchell]

• Request one SHA-scoped CodeRabbit review for each Dependabot update.
• Enable squash auto-merge only for the triggering head after required checks pass.
• Group GitHub Actions updates, remove autopep8, and refresh pinned tooling.
• Print an explicit release title in tag-release follow-up guidance.

Closes #198

Summary by CodeRabbit

• Chores

  • Improved automated dependency update handling and pull-request checks.
  • Updated development and code-quality tool versions.
  • Release commands now set release titles to the corresponding tag version.

• Documentation

  • Updated contributor setup instructions with the current uv version.

• Tests

  • Added coverage confirming release commands include the expected release title.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: d2ebe9a1-184a-4bf5-97e5-e286e32eba30

📥 Commits

Reviewing files that changed from the base of the PR and between 03a6dc7 and 2a37961.

⛔ Files ignored due to path filters (1)

• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (10)

• .coderabbit.yaml
• .github/dependabot.yml
• .github/workflows/dependabot-auto-merge.yml
• CONTRIBUTING.md
• README.md
• justfile
• pyproject.toml
• scripts/bench_compare.py
• scripts/tag_release.py
• scripts/tests/test_tag_release.py

---

📝 Walkthrough

Walkthrough

The pull request adds Dependabot review and auto-merge automation, groups GitHub Actions updates, enables CodeRabbit failure reporting, updates development-tool versions, and adjusts benchmark and release scripts with test coverage.

Changes

Dependabot review and auto-merge

Layer / File(s)	Summary
Dependabot and review policy .coderabbit.yaml, .github/dependabot.yml	CodeRabbit failure reporting is enabled. Dependabot now groups all GitHub Actions updates.
Review request and auto-merge workflow .github/workflows/dependabot-auto-merge.yml	The workflow validates the review token, avoids duplicate requests for the same head commit, requests a CodeRabbit review, and enables head-matched squash auto-merge.

Development tool updates

Layer / File(s)	Summary
Tool pins and contributor setup justfile, pyproject.toml, CONTRIBUTING.md, README.md	Development-tool pins and documented uv requirements now use newer versions.

Release and benchmark maintenance

Layer / File(s)	Summary
Benchmark parsing and release command scripts/bench_compare.py, scripts/tag_release.py, scripts/tests/test_tag_release.py	Benchmark provenance parsing removes a redundant cast. The release command sets the tag as the release title, and a test verifies the output.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• Automate Dependabot merges after CodeRabbit approval markov-chain-monte-carlo#111 — Covers the same Dependabot–CodeRabbit review automation, update grouping, and failure-status requirements.
• Automate Dependabot merges after CodeRabbit approval causal-triangulations#216 — Covers the same Dependabot auto-merge workflow and CodeRabbit enforcement changes.
• Automate Dependabot merges after CodeRabbit approval CDT-plusplus#131 — Covers the same Dependabot automation plan, action grouping, and CodeRabbit status enforcement.

Possibly related PRs

• acgetchell/la-stack#143 — Updates the same scripts/bench_compare.py module and overlaps with its provenance parsing changes.

Sequence Diagram(s)

sequenceDiagram
  participant Dependabot
  participant GitHubActions
  participant GitHubAPI
  participant CodeRabbit
  Dependabot->>GitHubActions: Open or synchronize pull request
  GitHubActions->>GitHubAPI: Validate token and check head marker
  GitHubActions->>GitHubAPI: Post review request
  GitHubAPI->>CodeRabbit: Deliver review request
  GitHubActions->>GitHubAPI: Enable squash auto-merge for head SHA

Loading

🚥 Pre-merge checks | ✅ 2 | ❌ 3

❌ Failed checks (2 warnings, 1 inconclusive)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The PR includes unrelated tooling updates, bench_compare changes, and tag-release changes that are not required by issue #198.	Move the unrelated tooling, bench_compare, and tag-release changes to separate pull requests or add linked requirements for them.
Docstring Coverage	⚠️ Warning	Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Linked Issues check	❓ Inconclusive	The workflow implements the requested review gating and SHA-scoped auto-merge, but live ruleset and Dependabot secret updates are not evidenced.	Provide evidence that the live ruleset and Dependabot secret were updated and that required checks and permissions remain compliant.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary change: gating Dependabot auto-merge on CodeRabbit approval.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/198-dependabot-auto-merge

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.86%. Comparing base (03a6dc7) to head (2a37961).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #199   +/-   ##
=======================================
  Coverage   97.86%   97.86%           
=======================================
  Files           8        8           
  Lines        4969     4969           
=======================================
  Hits         4863     4863           
  Misses        106      106           

Flag	Coverage Δ
unittests	97.86% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.