ci(repo): fix dependabot ignore syntax for openai/codex-action

[Coly010]

What kind of change does this PR introduce?

CI reliability fix (follow-up to #6538).

What is the current behavior?

#6538 re-pinned openai/codex-action to v1.11 and added a Dependabot ignore entry scoped to versions: ["1.12.x"], intending to still let Dependabot propose v1.13+ once the upstream hang bugs (openai/codex-action#151, #160) are fixed, while blocking the known-bad v1.12 line specifically.

That scoping never actually worked. 9 minutes after #6538 merged, Dependabot opened #6541 proposing the exact v1.12 bump we were trying to block — config propagation wasn't the issue; the versions syntax was. The github-actions ecosystem's ignore.versions strings are parsed as Ruby Gem::Requirement (RubyGems comparator syntax: >= x, ~> x, etc.), not npm-style semver ranges. "1.12.x" isn't a wildcard in that grammar — it parses as a literal version string with an implicit = operator, which never equals the real dependency version ("1.12"), so the ignore condition silently never matched anything.

Verified directly against the actual parsing logic dependabot-core uses (Dependabot::GithubActions::Requirement, a thin wrapper around Gem::Requirement):

GithubActionsRequirement.new("1.12.x").satisfied_by?(Gem::Version.new("1.12"))   # => false (bug)
GithubActionsRequirement.new(">= 1.12, < 1.13").satisfied_by?(Gem::Version.new("1.12"))    # => true
GithubActionsRequirement.new(">= 1.12, < 1.13").satisfied_by?(Gem::Version.new("1.12.5"))  # => true
GithubActionsRequirement.new(">= 1.12, < 1.13").satisfied_by?(Gem::Version.new("1.11"))    # => false
GithubActionsRequirement.new(">= 1.12, < 1.13").satisfied_by?(Gem::Version.new("1.13"))    # => false

What is the new behavior?

Replace versions: ["1.12.x"] with versions: [">= 1.12, < 1.13"] — a real Gem::Requirement comparator range, confirmed to correctly match the 1.12 line (including any 1.12.x patch) while excluding v1.11 and v1.13+. #6541 should be closed as superseded once this merges.

[github-actions]

🤖 AI Review

The Dependabot comparator change is functionally correct. Both reviews completed; Codex reported no findings. Claude’s two documentation/maintainability nits are confirmed: the provenance comment ambiguously cites the bump rather than the failed ignore change, and the whole-line exclusion can hide a corrective 1.12 patch.

Findings

Severity	Location	Category	Sources	Claim
⚪ NIT	.github/dependabot.yml:25	documentation	claude	The provenance comment associates the failed prior ignore attempt with PR #6541, although #6538 introduced the ineffective 1.12.x rule and #6541 was the subsequent Dependabot bump demonstrating that failure.
⚪ NIT	.github/dependabot.yml:28	maintainability	claude	Ignoring the complete 1.12 release line also suppresses notification of any future 1.12 patch containing the upstream fixes, while the adjacent guidance only discusses evaluating v1.13 or later.

Stats

Claude findings: 2 · Codex findings: 0 · Confirmed: 2 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5 + gpt-5.6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.