Harden Dependabot Update Planner into atomic, independently assignable work issues

[Copilot]

The live planner emitted one umbrella issue that was assigned to a coding agent (github/gh-aw#61573), producing a single PR that mixed npm, Go, and major GitHub Actions updates (github/gh-aw#61574) with inconsistent counts, missed migration invariants, lockfile drift, an incompatible/vulnerable candidate, and a Fixes # that closed the umbrella on partial work. Isolation was expressed only as prose, so nothing structurally prevented any of it.

Prompt contract (.github/workflows/dependabot-update-planner.md)

• Umbrella vs. work issues — the durable inventory issue is now explicitly unassignable; every actionable atomic group becomes its own assignable work issue mapping to exactly one independently mergeable PR. Packages share a work issue only across a hard edge (single lockfile/manifest resolution boundary).
• Stable identity — work issues carry a membership-independent marker keyed on the canonical boundary path, so find-or-create survives group membership changes:

  <!-- dependabot-work-group:repository=<owner>/<repo>;ecosystem=<ecosystem>;boundary=<canonical manifest, lockfile, or pin source path> -->
  

• One inventory, derived counts — summary totals must be computed from the final structured inventory, never generated independently.
• HEAD revalidation — every candidate is re-checked against the target repository's exact HEAD and classified current / stale / superseded / blocked / actionable.
• Canonical ownership — identify the canonical pin/manifest source, list generated consumers as must-not-edit, and flag duplicated literal pins that should route through an existing helper (e.g. getActionPin) instead of another literal SHA.
• Major-version migration review — release notes must yield concrete repository-specific invariants and validation steps (the upload-pages-artifact hidden-file / include-hidden-files: true case is encoded as the worked example).
• Candidate preflight — peer ranges and the resolved candidate dependency graph must be inspected; "no current Dependabot alerts" is insufficient to declare an update actionable.
• Version and lockfile discipline — exact targets are frozen, allowed transitive changes are enumerated, and resolver drift beyond the reviewed update is rejected.
• Completion semantics — Part of #... for partial batches, Fixes #... only for complete fulfillment; PR title, body, checklist, and validation report must stay synchronized with the final diff, and deferred items remain open and reported.
• Frontmatter safe-outputs.create-issue.max raised 1 → 10 (shared budget for umbrella + work issues, stated in exactly one place).

Tests and docs

• tests/fixtures/dependabot-update-planner-work-issues.json — seven regression fixtures derived from #61573/#61574, each carrying the evidence, the expected outcome, and the literal prompt phrases that must exist.
• tests/unit/workflow-contract-dependabot.test.mjs — fixture-driven contract assertions plus per-failure-mode tests (combined batch, count mismatch, hidden files, duplicated pin, lockfile drift, vulnerable candidate, umbrella closure).
• tests/unit/workflow-contract-safe-outputs.test.mjs updated for the new safe-output budget; dependabot/README.md describes the umbrella/work-issue model; lock file regenerated via npm run compile:locks.

• Fixes Harden Dependabot Update Planner issues for atomic, reviewable execution #12517

[github-actions]

Dashboard view assessment

No dashboard views were potentially impacted by this pull request.
Ignored views: operations, readiness.

View	Result	DOM nodes	Findings
View the workflow run.

[github-actions]

Workflow PR Validator

Validator	Status
npm run test:unit	pass (483/483)
npm run test:integration	pass (170/170)
npm run test:load	pass
npm run docs:build	pass
agentic-workflows compile	pass (no issues attributable to this PR)

Notes on compile

agentic-workflows compile reported 21 workflow failures of the form:

graders.operational-value.run "./graders/(name)-operational-value.sh" has invalid Bash syntax: exec: "bash": executable file not found in $PATH

This includes dependabot-update-planner.md, the workflow touched by this PR. This was verified to be a pre-existing sandbox/environment issue, not a regression introduced here:

• Direct bash -n syntax check on .github/workflows/graders/dependabot-update-planner-operational-value.sh passes cleanly.
• Re-running agentic-workflows compile against the merge-base commit on main (before this PR's changes) reproduces the identical 21 failures with the same "bash: executable file not found in $PATH" message. The compiler's grader-syntax-check subprocess cannot resolve bash in this run's $PATH, independent of any workflow content.
• No compiler warnings with concrete file/line locations were found in this PR's diff (dependabot-update-planner.md, dependabot-update-planner.lock.yml, dependabot/README.md, test files, fixture JSON).

No line-level review comments were added since no actionable, PR-attributable compiler findings were identified.

Generated by Workflow PR Validator for #12518 · copilot · auto · 59.1 AIC · ⌖ 5.28 AIC · ⊞ 7.1K