ci-status's Dependabot trust-path hold says a person merges it, but the ruleset leaves no path to merge

Problem

ci-status fails a Dependabot PR that changes a trust-gate path with "A person merges it" (.github/workflows/pr-require-checks.yml, the held_paths branch; owner decision Q24). But the main ruleset requires ci-status to pass and merges to go through the merge queue, and an admin cannot bypass it:

gh pr merge 11183 -R melodic-software/claude-code-plugins --squash --admin
GraphQL: Repository rule violations found
Required status check "ci-status" is failing.
Changes must be made through the merge queue

So a held Dependabot PR has no merge path at all. #11183 (claude-code-action 1.0.264 → 1.0.265) was worked around by re-authoring the bump as #11267.

Expected

The person Q24 names can lift the hold, for example with an approving review on the current head. Other gate/trust holds already work this way: an approving review lifts them, and removing the label does not.

Evidence

build: Bump anthropics/claude-code-action from 1.0.264 to 1.0.265 in the vendor-actions group across 1 directory #11183, ci-status run 41061651678: "build: Bump anthropics/claude-code-action from 1.0.264 to 1.0.265 in the vendor-actions group across 1 directory #11183 is by an author no review lane reviews and changes trust-gate paths: .github/workflows/post-merge-test-mutation.yml .github/workflows/pr-run-activity-write.yml. A person merges it."
The owner's admin merge attempt was refused, 2026-10-30 ~14:00Z (above).

Proposed work class: work-class: structural
Basis: automated intake triage; the lanes App applied this class.

Size: Small
Complexity: Medium
Uncertainty: Known
Flags: none
Blocked by: none

Understood: ci-status fails a Dependabot PR that changes trust-gate paths with "A person merges it". The main ruleset requires ci-status and the merge queue, and admin bypass is refused, so a held PR can't be merged by anyone. You expect an approving review on the current head from the person Q24 names to lift the hold, as the other gate and trust holds already do. No duplicate found among open issues. The approach looks clear from the issue. The fix changes trust logic in a workflow, so the code and security review lanes should judge the diff.

_{Automated triage, applied by the lanes App.}

Not admitted to the issue lane: no trusted-human acceptance criteria: a listed human must put the confirmed - [ ] criteria in the body or post them as their own comment, or, on an issue a listed human filed, intake's newest refinement comment must hold them unedited. Admission takes the issue once each of those is met, when intake triages it again (.github/actions/resolve-config/admission-rules.json).

The latest triage verdict holds nothing: admission moved the issue to status: confirmed; its comment says why.

Refinement. A read-only run explored this repository, searched its issues and pull requests, and read the allowed docs to draft what follows. On an issue a listed human filed, it counts as the issue's spec once posted, while unedited; it is still model text, so check it.

Intended outcome: ci-status lifts its Dependabot trust-gate path hold when a designated person approves the current head, so a held Dependabot PR can pass ci-status and go through the merge queue.

Related work

fix(ci): hold trust-path changes the agent App authored or pushed #10837 (related): Added the agent App trust-path hold in the same ci-status step; it shares the 'A person merges it' failure.
feat(pr-pipeline): add the base-branch agent-App trust-path hold #10962 (related): Added the base-branch agent-App trust-path hold, which also ends in 'A person merges it'.
chore(pr-pipeline): turn off the agent App trust-path and exempt-author path holds #11068 (related): Turned off the agent App and exempt-author path holds, which left Dependabot as the only held author (Q21/Q24).
feat(pr-merge): let a passed security review clear hold-enforcement paths, keep gate and trust paths held #10298 (related): Lets a passed security review clear some path holds while gate and trust paths stay held; the lift mechanism the issue refers to.
feat(pr-pipeline): stop holding on trusted paths and lane-clearable refusals #9826 (related): Stopped holding on trusted paths and lane-clearable refusals.
docs(adr): record that the review lanes gate merges through ci-status #11243 (related): ADR recording that the review lanes gate merges through ci-status, which is why admin merge is refused.
ci: drop the Dependabot merge gates' admission of the retired per-PR bump commit #8217 (related): Open work on the Dependabot merge gates in the same area.
fix(pr-pipeline): align every needs-human path with the owner stop rule #10517 (related): Open work aligning needs-human paths with the owner stop rule.

Open questions

Whose approving review lifts the Dependabot trust-gate hold: the repository owner only, a CODEOWNERS or trusted-actors member, or any user with write access?
RECOMMENDED: Only a user listed in .github/standards/trusted-actors/trusted-actors.json who is not the PR author, with the approval bound to the current head SHA. Basis: judgment
Is the lift an approving review only, or may a path-scoped alternative such as a passing security review also clear it?
RECOMMENDED: An approving review only. The path stays held when no such approval exists, and a new push to the head voids the approval. Basis: .base/.github/workflows/pr-require-checks.yml:5062
Should the same lift apply to the other 'A person merges it' failure at line 5158 (agent-App trust-path hold) and the fewer-files, fewer-commits and push-history fail-closed stops, or only the Dependabot held_paths branch at line 5062?
RECOMMENDED: Only the Dependabot held_paths branch at line 5062. The App hold is off in this repository, and the unreadable-input stops should keep failing closed. Basis: .base/docs/conventions/pr-pipeline/README.md:2566
Should the docs describe the admin bypass as break-glass? README line 2556 says it is, but the ruleset refuses it.
RECOMMENDED: Yes. Correct the README text, and document the approving-review lift as the supported path. Basis: .base/docs/conventions/pr-pipeline/README.md:2556

Sources read

.base/.github/workflows/pr-require-checks.yml:5017-5068: the Dependabot (exempt author) branch calls held_paths and fails with 'A person merges it.' when a trust-gate path changed. It reads no review.
.base/.github/workflows/pr-require-checks.yml:5077-5163: the agent-App trust-path hold has a second 'A person merges it' failure at line 5158.
.base/.github/workflows/pr-require-checks.yml:5022-5024: the generated guard empties hold_patterns for every author except Dependabot (id 49699333) while path-holds is false.
.base/docs/conventions/pr-pipeline.yaml:1118-1130: ci-status holds a Dependabot PR for trust-gate paths even with path-holds false (Q24).
.base/docs/conventions/pr-pipeline/README.md:2555-2577: documents the hold as 'a person merges it' and calls admin bypass break-glass, which the issue's ruleset refusal contradicts.
.base/scripts/ci-review-lanes.test.sh:125,444: tests that pin the Q21/Q24 behavior; they would need an approving-review case.
.base/.github/workflows/pr-require-checks.yml:5832: the only reviews API read in this file is the one at line 5832, so the held_paths branch has no approval check to extend.

To answer, post a comment that starts with this line:

**Decision recorded.** <answer>

_{Automated refinement by the lanes App. Answer with a comment whose first line is **Decision recorded.**.}

Navigation Menu

Repository navigation

ci-status's Dependabot trust-path hold says a person merges it, but the ruleset leaves no path to merge #11270

Problem

Expected

Evidence

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

ci-status's Dependabot trust-path hold says a person merges it, but the ruleset leaves no path to merge #11270

Description

Problem

Expected

Evidence

Activity

github-actions commented on Oct 30, 2026

melodic-automation-lanes commented on Oct 30, 2026

melodic-automation-lanes commented on Oct 30, 2026

melodic-automation-lanes commented on Oct 30, 2026

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions