From 2dafc7842d326ee89d5f7942513505fb94ba2075 Mon Sep 17 00:00:00 2001
From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
Date: Wed, 20 May 2026 14:59:02 +0000
Subject: [PATCH] =?UTF-8?q?feat:=20implement=20issue=20#132=20=E2=80=94=20?=
 =?UTF-8?q?Compliance:=20non-stub-dependabot-rebase.yml?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/dependabot-rebase.yml | 38 ++++++++++++++-----------
 .gitignore                              |  1 +
 2 files changed, 22 insertions(+), 17 deletions(-)
 create mode 100644 .gitignore

diff --git a/.github/workflows/dependabot-rebase.yml b/.github/workflows/dependabot-rebase.yml
index a9857dd..0cecb7f 100644
--- a/.github/workflows/dependabot-rebase.yml
+++ b/.github/workflows/dependabot-rebase.yml
@@ -1,34 +1,38 @@
 # ─────────────────────────────────────────────────────────────────────────────
 # SOURCE OF TRUTH: petry-projects/.github/standards/workflows/dependabot-rebase.yml
-# Standard:        petry-projects/.github/standards/dependabot-policy.md
-# Reusable:        petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml
+# Standard: petry-projects/.github/standards/dependabot-policy.md
+# Reusable: petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml
 #
 # AGENTS — READ BEFORE EDITING:
-#   • This file is a THIN CALLER STUB. All rebase/merge serialization logic
-#     lives in the reusable workflow above.
-#   • You MAY change: the ref in the `uses:` line when upgrading the reusable
-#     workflow version (bump to latest commit SHA or tag of petry-projects/.github).
-#   • You MUST NOT change: the concurrency group name, the explicit secrets
-#     block, or the job-level `permissions:` block — reusable workflows can be
-#     granted no more permissions than the calling job has, so removing the
-#     stanza breaks the reusable's gh API calls. Do not remove either trigger
-#     (`push` keeps the self-sustaining chain; `workflow_dispatch` allows
-#     manual queue flushes).
-#   • If you need different behaviour, open a PR against the reusable in the
-#     central repo.
+# • This file is a THIN CALLER STUB. All rebase/merge serialization logic
+# lives in the reusable workflow above.
+# • You MAY change: the ref in the `uses:` line when upgrading the reusable
+# workflow version (bump to latest commit SHA or tag of petry-projects/.github).
+# • You MUST NOT change: the concurrency group name, the explicit secrets
+# block, or the job-level `permissions:` block — reusable workflows can be
+# granted no more permissions than the calling job has, so removing the
+# stanza breaks the reusable's gh API calls. Do not remove any trigger
+# (`push` keeps the self-sustaining chain; `schedule` is the safety net
+# when no PR merges have occurred recently; `workflow_dispatch` allows
+# manual queue flushes).
+# • If you need different behaviour, open a PR against the reusable in the
+# central repo.
 # ─────────────────────────────────────────────────────────────────────────────
 #
 # Dependabot update-and-merge — thin caller for the org-level reusable.
 # To adopt: copy this file to .github/workflows/dependabot-rebase.yml in your repo.
 # Required org secrets (passed explicitly):
-#   APP_ID         — GitHub App ID with pull-requests:write
-#   APP_PRIVATE_KEY — GitHub App private key
+# APP_ID — GitHub App ID with contents:write and pull-requests:write
+# APP_PRIVATE_KEY — GitHub App private key
+
 name: Dependabot update and merge
 
 on:
   push:
     branches:
       - main
+  schedule:
+    - cron: '0 */4 * * *' # every 4 hours — safety net when no pushes to main trigger the chain
   workflow_dispatch: # allow manual trigger to flush Dependabot PR queue
 
 concurrency:
@@ -41,7 +45,7 @@ jobs:
   dependabot-rebase:
     permissions:
       pull-requests: write # call update-branch API on behind PRs and merge when ready
-    uses: petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@e6d47e0571ad88f1c4944be17da5b913dcc8c4e4 # v1
+    uses: petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@b51e2edf830ea085be0277bcf3174c7b3ec8f958 # v1
     secrets:
       APP_ID: ${{ secrets.APP_ID }}
       APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..2049ac3
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.dev-lead/