ci: grant checks/statuses, fail closed on an absent rollup, widen push paths

Four fixes from the ninth review on #844. The first is a fail-open hole.

Grant checks: read and statuses: read. statusCheckRollup is the gate both the
workflow and the merge script depend on, and it is built from Checks resources and
commit statuses — neither of which a permissions block naming only contents,
pull-requests and actions grants. Either GraphQL errors, making the workflow a
permanent no-op that looks healthy, or it returns the field empty, which `[]?` would
have swallowed as "all checks green" and merged past a red Commit Lint. That is the
exact check #799 shows going red on a Dependabot pull request.

Belt and braces on the same hole: the script now refuses outright when
statusCheckRollup is not an array, so neither an absent permission nor a head with
no checks yet can read as success. It used to merge in that case; it now skips and
lets the sweep look again.

The drift guard read only the plural `directories`. The singular `directory` is
equally valid and is the canonical form for one directory, so an entry using it
contributed nothing and its manifest was reported as unclaimed — validate failing on
correct config, with a message telling the author to add an entry already in the
file. Both spellings are read now.

The drift guard also asserts the two keys the grouping actually rests on.
`applies-to: security-updates` is load-bearing because plain groups batch version
updates only, and those are off via the limit; a 48th entry copy-pasted without it
would pass every check here while its advisories reverted to one pull request each.
A missing or non-zero open-pull-requests-limit is the mirror image. With 47
near-identical entries these are exactly the copy-paste omissions worth machine
checking.

Widen the push trigger to every input the selector calls shared. It listed only
src/**, so layer/**, Cargo.toml and Cargo.lock were verified against the examples on
no event at all — and layer/bootstrap is the code path all eight zip examples boot,
since build-layer copies it into the artifact each of them injects. The comment
claiming those changes are covered on push to main is now true. Pull request triggers
are unchanged, so source pull requests still do not fan out to eighteen jobs.

Twenty merge-script paths re-run with expected exit codes, zero mismatches, plus the
drift guard against a singular-directory entry, a missing applies-to, a non-zero
limit, and the clean tree.

Author: bnusunny

.github/scripts/check-example-config.sh

@@ -79,12 +79,38 @@ for path in tracked:
             found.add((ecosystem, directory))
 
 configured = set()
+problems = []
 config = yaml.safe_load(open(dependabot_path))
 for update in config["updates"]:
-    for directory in update.get("directories", []):
-        configured.add((update["package-ecosystem"], directory))
-
-problems = []
+    ecosystem = update["package-ecosystem"]
+
+    # Both spellings are valid Dependabot config. This file uses the plural throughout,
+    # but the singular is the canonical form for one directory and is what someone
+    # adding an entry is likely to reach for — reading only the plural would report
+    # their manifest as unclaimed and tell them to add an entry that is already there.
+    directories = list(update.get("directories") or [])
+    if "directory" in update:
+        directories.append(update["directory"])
+    for directory in directories:
+        configured.add((ecosystem, directory))
+
+    where = f"{ecosystem} {directories}"
+
+    # Both keys below are load-bearing, and an entry copy-pasted without either looks
+    # correct here while silently reverting that example to what this file exists to
+    # prevent. Plain `groups` batches version updates only, so without
+    # `applies-to: security-updates` the grouping does not apply to the advisories that
+    # are the whole point.
+    groups = update.get("groups") or {}
+    if not any(g.get("applies-to") == "security-updates" for g in groups.values()):
+        problems.append(f"{where}: needs a group with `applies-to: security-updates`, "
+                        "or its security updates arrive one pull request per advisory.")
+
+    # And a missing or non-zero limit turns routine version bumps back on for that one
+    # example.
+    if update.get("open-pull-requests-limit") != 0:
+        problems.append(f"{where}: needs `open-pull-requests-limit: 0`, or version "
+                        "updates come back on for it.")
 
 unclaimed = sorted(found - configured)
 if unclaimed:

.github/scripts/dependabot-automerge.sh

@@ -88,6 +88,12 @@ head_sha=$(jq -r '.headRefOid' <<<"$pr_json")
 # yet — a real few-second window every time Dependabot force-pushes a rebase — and
 # iterating null aborts jq. The sweep's pre-filter already tolerates it, which is what
 # makes the combination reachable: it would pass such a pull request straight to here.
+# An absent rollup must never read as "everything passed": that is the shape a missing
+# checks/statuses permission would produce, and `[]?` alone would swallow it and merge.
+if [[ "$(jq -r '.statusCheckRollup | type' <<<"$pr_json")" != "array" ]]; then
+  skip "no check rollup available for $head_sha (yet)."
+fi
+
 not_green=$(jq -r '
   .statusCheckRollup[]?
   | select((.workflowName // "") != "Dependabot Auto-merge")

.github/workflows/dependabot-automerge.yaml

@@ -52,6 +52,14 @@ permissions:
   # permissions block sets every scope not named here to none, so without this the
   # Actions API returns 403. Same reason commitlint-comment.yaml declares it.
   actions: read
+  # statusCheckRollup is the gate both this file and dependabot-automerge.sh depend on,
+  # and it is made of Checks resources (CheckRun nodes) and commit statuses
+  # (StatusContext nodes). Without these two the query either errors — making the whole
+  # workflow a no-op that looks healthy — or comes back empty, which would read as "all
+  # checks green" and merge past a red Commit Lint. The script also refuses an absent
+  # rollup outright, so neither failure can be mistaken for success.
+  checks: read
+  statuses: read
 
 jobs:
   merge:

.github/workflows/examples.yaml

@@ -18,13 +18,19 @@ on:
   push:
     branches:
       - main
+    # Every input select-examples.sh treats as shared, not just src/. layer/bootstrap in
+    # particular is the code path all eight zip examples boot — build-layer copies it
+    # into the artifact each of them injects — so leaving it out meant a regression there
+    # was verified by nothing at all.
     paths:
       - "src/**"
-  # Note that src/, layer/ and Cargo.* are deliberately NOT pull request triggers,
-  # even though select-examples.sh treats them as shared: adding them would run all
-  # eighteen matrix entries on every source pull request. Adapter changes are verified
-  # against the examples on push to main (above), and the selector's shared-path rule
-  # still applies to a pull request that touches both source and examples.
+      - "layer/**"
+      - "Cargo.toml"
+      - "Cargo.lock"
+  # Those same paths are deliberately NOT pull request triggers: adding them would run
+  # all eighteen matrix entries on every source pull request. Adapter changes are
+  # verified against the examples on push to main (above), and the selector's shared-path
+  # rule still applies to a pull request that touches both source and examples.
   workflow_dispatch:
 
 permissions: