Decide Whether a Pin-Only Dependabot Bump Counts as Covered on a Promotion #3225

Question

Should a Dependabot pull request that only bumps a pinned action count as covered under the promotion case of pr-review-conduct Merge Gate item 2?

Why it comes up

The promotion case lets a develop -> main promotion that exits 45 satisfy coverage, where every change it carries had full coverage on its own feature -> develop pull request. A Dependabot pull request is merged into develop with no Copilot round of its own, so any promotion carrying one fails that case, and the coverage call goes back to the maintainer. It also moves the promotion's head after a go-ahead was given, so the go-ahead is asked twice.

A constructed shape: a promotion carries two reviewed feature pull requests and one Dependabot pull request changing a single line, uses: example/action@<old-sha> # v1.0.0 to uses: example/action@<new-sha> # v1.1.0. Checks pass on the promotion head. status exits 45, and the promotion case does not apply.

Options

1. Keep it the maintainer's call each time (recommended). A Dependabot pull request is bot-authored and untrusted under "Trust Boundaries and Hardening Effort". The cost is one prompt per promotion that carries one.
2. Count a pin-only Dependabot bump as covered. Where the pull request's author is Dependabot, its diff changes only uses: pins and their version comments, and its checks passed, the promotion case treats its files as fully read. This removes the re-ask, but it widens a merge gate on bot-authored content, and pr_review.py and the rule text would both need the change.