ci(dependabot): gate auto-merge on CodeRabbit approval

.coderabbit.yaml

@@ -9,7 +9,7 @@ reviews:
   # The review-progress path creates a second GitHub check run for the same review.
   review_progress: false
   commit_status: true
-  fail_commit_status: false
+  fail_commit_status: true
   tools:
     github-checks:
       enabled: true

.github/dependabot.yml

@@ -11,6 +11,10 @@ updates:
     labels:
       - "dependencies"
       - "github-actions"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
 
   # Enable version updates for Rust dependencies
   - package-ecosystem: "cargo"

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,66 @@
+name: Dependabot review and auto-merge
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - ready_for_review
+      - synchronize
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  review-and-enable-auto-merge:
+    if: >-
+      github.event.pull_request.user.login == 'dependabot[bot]' &&
+      github.repository == 'acgetchell/la-stack'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Request CodeRabbit review
+        env:
+          # Dependabot-triggered workflows receive Dependabot secrets.
+          GH_TOKEN: ${{ secrets.CODERABBIT_REVIEW_TOKEN }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          if [[ -z "$GH_TOKEN" ]]; then
+            echo "::error::CODERABBIT_REVIEW_TOKEN is not configured."
+            exit 1
+          fi
+
+          token_owner="$(gh api user --jq '.login')"
+          if [[ "$token_owner" != "acgetchell" ]]; then
+            echo "::error::CODERABBIT_REVIEW_TOKEN must belong to acgetchell."
+            exit 1
+          fi
+
+          marker="<!-- coderabbit-review-request:${PR_HEAD_SHA} -->"
+          comments="$(
+            gh api --paginate \
+              "repos/${REPOSITORY}/issues/${PR_NUMBER}/comments" \
+              --jq '.[] | select(.user.login == "acgetchell") | .body'
+          )"
+          if grep -Fxq -- "$marker" <<< "$comments"; then
+            echo "CodeRabbit review already requested for ${PR_HEAD_SHA}."
+            exit 0
+          fi
+          body="$(printf '@coderabbitai review\n\n%s' "$marker")"
+          gh api \
+            --method POST \
+            "repos/${REPOSITORY}/issues/${PR_NUMBER}/comments" \
+            --raw-field body="$body"
+
+      - name: Enable auto-merge
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: gh pr merge --auto --squash --match-head-commit "$PR_HEAD_SHA" "$PR_URL"

CONTRIBUTING.md

@@ -7,7 +7,7 @@ clarity, and the fixed-dimension stack-allocation model.
 ## Getting Started
 
 Install Rust 1.97.0 through [rustup](https://rustup.rs/), Git, Python 3.14,
-[`uv` 0.11.28](https://docs.astral.sh/uv/), and `jq`. Install the repository's
+[`uv` 0.12.0](https://docs.astral.sh/uv/), and `jq`. Install the repository's
 pinned `just` version from its locked dependency graph:
 
 ```bash

README.md

@@ -571,7 +571,7 @@ cargo run --features exact --example exact_solve_3x3
 A short contributor workflow:
 
 Install Rust 1.97.0 through [rustup](https://rustup.rs/), Git, Python 3.14,
-[`uv` 0.11.28](https://docs.astral.sh/uv/), and `jq`. Then install the pinned
+[`uv` 0.12.0](https://docs.astral.sh/uv/), and `jq`. Then install the pinned
 `just` release from its locked dependency graph:
 
 ```bash

justfile

@@ -14,14 +14,14 @@ export PATH := cargo_home + "/bin" + path_separator + env_var("PATH")
 cargo_machete_version := "0.9.2"
 cargo_nextest_version := "0.9.140"
 cargo_llvm_cov_version := "0.8.7"
-dprint_version := "0.55.1"
+dprint_version := "0.55.2"
 git_cliff_version := "2.13.1"
 just_version := "1.56.0"
-rumdl_version := "0.2.31"
+rumdl_version := "0.2.47"
 taplo_version := "0.10.0"
 typos_version := "1.48.0"
-uv_version := "0.11.28"
-zizmor_version := "1.26.1"
+uv_version := "0.12.0"
+zizmor_version := "1.28.0"
 
 # Internal helpers: ensure external tooling is installed
 _ensure-actionlint:

pyproject.toml

@@ -145,10 +145,10 @@ package = true
 dev = [
     "actionlint-py==1.7.12.24",
     "pytest==9.1.1",
-    "ruff==0.15.21",
-    "semgrep==1.169.0",
+    "ruff==0.16.1",
+    "semgrep==1.172.0",
     "shellcheck-py==0.11.0.1",
     "shfmt-py==4.0.0",
-    "ty==0.0.58",
+    "ty==0.0.65",
     "yamllint==1.38.0",
 ]

scripts/bench_compare.py

@@ -627,7 +627,7 @@ def _parse_criterion_metadata(
     return CriterionProvenance(
         suite=cast("BenchmarkSuite", suite),
         scope=cast("ComparisonScope", scope),
-        statistic=cast("Statistic", statistic),
+        statistic=statistic,
         sample=sample,
         criterion_version=criterion_version,
         baseline_command=commands["baseline_command"],
@@ -1437,9 +1437,11 @@ def _provenance_markdown(provenance: HarnessProvenance) -> list[str]:
     """Render validated provenance without implying facts absent from metadata."""
     if provenance.schema == 1:
         return [
-            "**Harness provenance**: legacy shared current harness metadata from "
-            f"`.la-stack-benchmark-harness.json` (baseline source `{provenance.baseline}`, SHA-256 `{provenance.sha256}`). "
-            "CPU, OS, rustc, commits, Criterion configuration, and fixture-gate results were not recorded."
+            (
+                "**Harness provenance**: legacy shared current harness metadata from "
+                f"`.la-stack-benchmark-harness.json` (baseline source `{provenance.baseline}`, SHA-256 `{provenance.sha256}`). "
+                "CPU, OS, rustc, commits, Criterion configuration, and fixture-gate results were not recorded."
+            )
         ]
 
     if provenance.measurement is None or provenance.publication is None or provenance.criterion is None or provenance.validation is None:

scripts/tag_release.py

@@ -361,7 +361,7 @@ def create_tag(tag_version: str, *, force: bool = False) -> None:
         print(f"  1. Force-push the tag: {_BLUE}git push --force origin {tag_version}{_RESET}")
     else:
         print(f"  1. Push the tag: {_BLUE}git push origin {tag_version}{_RESET}")
-    print(f"  2. Create GitHub release: {_BLUE}gh release create {tag_version} --notes-from-tag{_RESET}")
+    print(f"  2. Create GitHub release: {_BLUE}gh release create {tag_version} --title {tag_version} --notes-from-tag{_RESET}")
     if is_truncated:
         print(f"\n{_YELLOW}Note: Tag annotation references CHANGELOG.md due to size (>125KB).{_RESET}")
 

scripts/tests/test_tag_release.py

@@ -227,6 +227,25 @@ def test_oversized_section_detected(self, tmp_path: Path) -> None:
 
 
 class TestCreateTag:
+    def test_next_step_sets_release_title(
+        self,
+        tmp_path: Path,
+        capsys: pytest.CaptureFixture[str],
+    ) -> None:
+        changelog = tmp_path / "CHANGELOG.md"
+        with (
+            patch("tag_release._tag_exists", return_value=False),
+            patch("tag_release.find_changelog", return_value=changelog),
+            patch(
+                "tag_release.extract_changelog_section",
+                return_value=("### Added\n\n- Something new", changelog),
+            ),
+            patch("tag_release.run_git_command_with_input"),
+        ):
+            tag_release.create_tag("v1.0.0")
+
+        assert "gh release create v1.0.0 --title v1.0.0 --notes-from-tag" in capsys.readouterr().out
+
     @patch("tag_release.run_git_command_with_input")
     @patch("tag_release._tag_exists", return_value=False)
     @patch("tag_release.find_changelog")