fix(dependabot-rebase): re-approve PRs after branch updates to unblock auto-merge

.github/workflows/dependabot-rebase-reusable.yml

@@ -90,9 +90,37 @@ jobs:
 
             if [[ "$BEHIND" -gt 0 ]]; then
               echo "PR #$PR_NUMBER ($HEAD_REF) is $BEHIND commit(s) behind — merging main into branch"
-              gh api "repos/$REPO/pulls/$PR_NUMBER/update-branch" \
+              if gh api "repos/$REPO/pulls/$PR_NUMBER/update-branch" \
                 -X PUT -f update_method=merge \
-                --silent || echo "Warning: failed to update PR #$PR_NUMBER"
+                --silent; then
+                echo "  Branch updated"
+                # Only re-approve if auto-merge is enabled. Auto-merge is set exclusively
+                # by the dependabot-automerge workflow after confirming eligibility (patch/
+                # minor updates or GitHub Actions). This guards against re-approving PRs
+                # that the policy intentionally leaves for human review (e.g. major non-
+                # Actions updates).
+                #
+                # Note: update-branch creates a merge commit authored by GitHub's
+                # infrastructure (not the app token), so require_last_push_approval is
+                # satisfied when the app re-approves — the pusher and approver are
+                # different identities.
+                AUTO_MERGE_ENABLED=$(gh pr view "$PR_NUMBER" --repo "$REPO" \
+                  --json autoMergeRequest --jq '.autoMergeRequest != null')
+                if [[ "$AUTO_MERGE_ENABLED" == "true" ]]; then
+                  echo "  Re-approving to refresh stale approval"
+                  if gh pr review "$PR_NUMBER" --repo "$REPO" --approve \
+                    --body "Re-approved after branch update to keep up-to-date with main." \
+                    --silent; then
+                    echo "  Re-approved PR #$PR_NUMBER"
+                  else
+                    echo "  Warning: failed to re-approve PR #$PR_NUMBER — PR will remain blocked until manually re-approved"
+                  fi
+                else
+                  echo "  Skipping re-approval — auto-merge not enabled (PR may require human review)"
+                fi
+              else
+                echo "Warning: failed to update PR #$PR_NUMBER"
+              fi
               continue
             fi
 

standards/github-settings.md

@@ -131,7 +131,7 @@ rules are deprecated — migrate existing classic rules to rulesets.
 | **Dismiss stale reviews on push** | **Yes** — prevents merging unreviewed code after approval |
 | **Required review thread resolution** | **Yes** — all threads must be Resolved before merge |
 | **Require code owner review** | **Yes** — requires approval from a CODEOWNERS-defined owner |
-| **Require last push approval** | **Yes** — the person who pushed last cannot be the sole approver |
+| **Require last push approval** | **Yes** — ensures different people review substantive code changes; Dependabot rebase workflow re-approves after branch updates to maintain approval validity |
 | **Allowed merge methods** | **Squash only** |
 | **Allow force pushes** | No |
 | **Allow deletions** | No |