ci: pr-issue-linkage gate structurally fails dependabot PRs — dependency updates unmergeable

[kyle-sexton]

Found at checkpoint (control tower, 2026-07-20 12:20Z): PR #669 (dependabot bump of @anthropic-ai/claude-code, package.json + lockfile only) sits UNSTABLE with pr-issue-linkage / pr-issue-linkage FAILURE — a dependabot PR has no closing-keyword issue link and can never satisfy the gate, so every dependency-update PR is permanently unmergeable while the check is required.

Fix direction: exempt bot dependency authors (dependabot[bot]; consider renovate) from the linkage requirement — actor-based skip in the workflow (fail-closed for all human/lane authors, exempt only the known dependency bots), or auto-link a standing dependencies umbrella issue. If the linkage check is a reusable workflow, the exemption belongs in melodic-software/ci-workflows with a caller flag; otherwise in this repo's workflow.

Evidence: #669 checks rollup — pr-issue-linkage FAILURE, all other checks green; dependencies label exists in the taxonomy already.

[kyle-sexton]

This was generated by AI during triage.

Confirmed root cause and location: .github/workflows/pr-issue-linkage.yml in this repo is a thin caller — the actual body-validation logic (closing-keyword + ## Related check) lives in the reusable workflow melodic-software/ci-workflows/.github/workflows/pr-issue-linkage.yml, called via uses:. That reusable's workflow_call inputs are only runner and prerequisite-result — there is no actor-exemption input today. So a dependabot/renovate PR (no linked issue by construction) fails this required check with no way to satisfy it, for every repo that calls this reusable, not just this one.

That makes the fix genuinely cross-repo policy, not a local config change: whatever exemption mechanism is chosen becomes part of the reusable's public contract for every consumer. Per this org's own ownership split, reusable-workflow execution changes belong in ci-workflows, not here.

Recommended shape (for whoever picks this up in ci-workflows, not this repo):

• Add a workflow_call input to the reusable, e.g. skip-bot-authors: boolean (default true), or a skip-authors: string (comma-separated login list) for more control than a bool.
• Skip validation (green, not merely non-blocking) when github.event.pull_request.user.login matches a known dependency-bot login (dependabot[bot]; renovate[bot] if/when adopted) AND the caller opted in.
• This repo's caller (.github/workflows/pr-issue-linkage.yml) then sets the new input; no other change needed here once the reusable ships it.
• Alternative considered and rejected as a default: auto-linking every dependency PR to a standing "dependencies" umbrella issue via a bot comment injecting a closing keyword — works, but couples the gate's pass condition to comment-injection ordering and is more moving parts than an actor-based skip for the same outcome. Worth keeping as a fallback only if the ci-workflows maintainer has a reason to avoid a new input.

Why human-gated: this changes a shared reusable workflow's public contract consumed by every repo that requires this check — a cross-repo policy call, not a design space this lane can default and let a maintainer veto after the fact. Needs a ci-workflows maintainer/PR, then a small follow-up here once it ships.

Related: #669 (the dependabot PR that surfaced this), dependencies label (already exists in this repo's taxonomy).

[kyle-sexton]

Fix chain in flight (operator momentum delegation)

The pr-issue-linkage gate structurally failing dependabot PRs is being fixed as a two-repo chain:

1. Upstream (reusable): feat(pr-issue-linkage): add exempt-authors opt-in for bot PRs ci-workflows#171 — adds an opt-in exempt-authors input (comma-separated exact logins, default empty, fail-closed). Closes ci-workflows#149. OPEN, CI green (JS tests 17/17, actionlint + zizmor clean); awaiting review/merge.
2. Caller opt-in (this repo): ci(pr-issue-linkage): exempt dependabot[bot] from the body gate #748 (DRAFT, blocked-by ci-workflows#171) — passes exempt-authors: 'dependabot[bot]'. Closes #684.

Remaining steps (after ci-workflows#171 merges):

• Bump ci(pr-issue-linkage): exempt dependabot[bot] from the body gate #748's uses: pin from @90f1c54 to the build(dependabot): stop proposing governed reusable-workflow bumps #171 merge SHA (+ trailing version comment), remove the DRAFT/BLOCKED marker, mark ready.
• Merge ci(pr-issue-linkage): exempt dependabot[bot] from the body gate #748.
• Cross-consumer pin bumps tracked in ci-workflows#157.

Standard veto window applies on both PRs before merge.