[objectstack-fleet]

Requested by Tesla · project thread

Fixes #13497
Part of objectstack-ai/objectstack#25677

Clause-②: no
Metadata-protocol: none

⛔ Governed surface (.github/workflows/**, Tier H). This PR stays a draft until an APPROVED review from an authorized approver (os-zhuang or hotlong) is on record; the merge-queue leg of the Governed Surface Queue Guard refuses it otherwise. No agent seat approves it; the dispatch seat lands it after the approval.

维护者速读(草稿)

• 改了什么: 把 dependabot-auto-merge.yml 的唯一 job 关掉(if: false),只改这一个文件,文件头写明原因和怎么恢复。
• 为什么改: 这个 job 用 GITHUB_TOKEN 把 Dependabot PR 放进合并队列。GitHub 不会为 GITHUB_TOKEN 触发的事件启动 workflow,所以这个合并组永远没有检查在跑,要等约 63 分钟超时才被踢出;排在它后面的所有 PR(包括 objectui→objectstack 合并的各张卡)都干等。Dependabot 每次 rebase 都会重来一次。今天 10:54Z 又一次:chore(deps): Bump next from 16.3.8 to 16.4.1 #13438 的合并组 0 个 run,排在后面的 feat(types)!: nine duration keys carry their unit in their name, old spellings refused by name (objectstack#25762) #13515 合并组 5/5 已绿,在等它。
• 风险与代价(含回滚): 合并之后到 cutover 归档之前,Dependabot PR 不再被自动批准、入队或评论;要落某个 Dependabot PR 就手动入队。没有新增 secret,没有缩短队列超时,没有删任何 required check。回滚 = 把 job 的条件改回 github.actor == 'dependabot[bot]'(文件头写了),或者 revert 这个 PR。
• 席位意见:
• 你要做的(一个动作): 读完 diff 后在本 PR 点 Approve。

What changes

One file, .github/workflows/dependabot-auto-merge.yml:

• The dependabot job's condition becomes if: false, with a one-line pointer to the header.
• A new header block says why the job is off, what the ruling ruled out, and how to turn it back on (restore github.actor == 'dependabot[bot]', and fix the GITHUB_TOKEN enqueue first).
• Every step is left as it was. Nothing else in the repository changes.

Why

The job's last step enqueues with gh pr merge --auto --squash --match-head-commit under GITHUB_TOKEN. GitHub starts no workflow run for an event that GITHUB_TOKEN caused, so the merge group gets no merge_group runs, its required checks never report, and it holds the head of the queue until the check timeout removes it. The card's measurements (the third removal, still pending when the card was filed, is read from #13438's timeline):

enqueued (added_to_merge_queue, by github-actions[bot])	removed (removed_from_merge_queue)	held
2026-10-24 05:31Z	06:35Z	64 min
2026-10-24 23:16Z	2026-10-25 00:19Z	63 min
2026-10-25 02:34Z	03:34Z	60 min

A fourth cycle was live while this PR was written: Dependabot force-pushed #13438 at 10:40:58Z, github-actions[bot] enqueued it at 10:54:47Z, and at 11:55Z its merge group (gh-readonly-queue/main/pr-13438-…, head 6523401e4b) had 0 workflow runs, while the group right behind it (#13515, enqueued by the fleet App) had 5 of 5 runs at success, waiting.

The triage ruling on #13497 (comment 6393154205) chose the cheaper of the card's two ways, because this repository is archived at the objectstack-ai/objectstack#25677 cutover: stop enqueuing Dependabot pull requests from Actions, by dropping the enqueue step or disabling the workflow until cutover. ⛔ No App or PAT secret, no shorter queue timeout, no dropped required checks.

Why the whole job, not just the enqueue step

Both forms were measured against the tests that read this workflow:

Form	scripts/__tests__/dependabot-merge-gate.test.ts
Delete the "Enqueue for merge" step only	2 failed / 33 passed: "has no gh pr merge that is not behind a green gate" (its anti-vacuity count reads 0) and "runs the gate script and tells it which SHA to judge" (no --match-head-commit left)
if: false on the job (this PR)	35 passed

Dropping only the step would mean rewriting those two pins as well. It would also keep the gate running on every Dependabot rebase in the cutover window: one runner polling for up to 40 minutes, only to approve a pull request that nothing enqueues. With the job off, the workflow stays as it is, and the tests that pin it don't change.

Verification (local, head b3d92a46a4)

Gate	Exit / verdict
node scripts/check-governed-queue-guard.mjs --test .github/workflows/dependabot-auto-merge.yml	3 = GOVERNED (.github/workflows/** x1), as expected
node scripts/check-changeset-presence.mjs	0, no changeset owed
check-control-bytes, check-action-ref-convention, check-pre-install-import-graph (--self-test and run), check-shell-escape-residue, check-governed-queue-guard --self-test, check-required-check-set --self-test, check-bash32-floor, check-new-cross-file-line-citations, check-doc-links	0 each
vitest, the four scripts/__tests__ files that name this workflow	0 (159 tests)
vitest, all of scripts/__tests__ (under os-verify-lock)	1: 5863 passed, 3 failed, all Test timed out in 15000ms in files that do not read this workflow (check-i18n-dead-keys, check-vi-mock-inherit, dollar-dialect-alias-census); the same three files re-run alone on this head: 0 (259 tests)
YAML parse of the edited file	job if is the boolean false; 10 steps, unchanged

What can't be tested on this PR: the workflow triggers only on a Dependabot pull request, so this PR can't run the changed job. The check comes after the merge: the next Dependabot force-push should produce a skipped dependabot job and no added_to_merge_queue event.

Acceptance notes

• Prose elsewhere still says this workflow approves and enqueues: content/docs/guide/ci-cd-pipeline.md (workflow table row and the "Dependabot Auto-Merge" section), AGENTS.md (the governed-surface list and the merge-queue paragraph), the dependabot-auto-merge.yml reason in scripts/check-action-ref-convention.mjs, and header comments in scripts/dependabot-merge-gate.mjs and scripts/check-governed-queue-guard.mjs. Not changed here: the card's scope is the workflow, and the repository is archived at cutover. These are reported to the dispatch seat.

• Fixing this doesn't clear the current queue head. The chore(deps): Bump next from 16.3.8 to 16.4.1 #13438 entry enqueued at 10:54:47Z stays until its timeout, or until a maintainer removes it from the queue.

• Adds no product-specific widget, dialog, hook or string (see AGENTS.md › Product-neutral renderer)

🤖 Generated with Claude Code

Session: https://claude.ai/code/session_01DqwYJmM7nGqhoj84ZUJ9Cz

[objectstack-fleet]

Dispatch seat record. ACCEPTed on card #13497 (takeover under the maintainer's 2-hour no-progress rule). check-governed-merges --pr objectstack-ai/objectui#13527: ⛔ GOVERNED — .github/workflows/** ×1, landing tier H: this PR needs an APPROVED review from a GOVERNED_APPROVERS member (os-zhuang / hotlong); the dispatch seat then arms auto-merge. 28 changed lines (+27/−1). CI on head b3d92a46a4: 33 check runs, 30 success, 3 skipped, 0 failed. The approval ask is with the maintainer; no seat approves this PR; no further push lands on the branch, so the approval stays valid.

---

Generated by Claude Code