ci(pr-issue-linkage): exempt dependabot[bot] from the body gate (signed supersede of #748)

[kyle-sexton]

Summary

Caller opt-in for the exempt-authors input on the shared
pr-issue-linkage reusable. dependabot PR bodies cannot carry the
closing-keyword + ## Related markers this required gate demands, so
every dependency-update PR currently fails the check and is unmergeable
(see #669 for a live example blocked by this today). Passing
exempt-authors: 'dependabot[bot]' skips body validation for that
login only.

The pin is bumped to melodic-software/ci-workflows@d7734df8c557084edc2df7cf578cf62ad2f261e4,
the merge SHA of ci-workflows#171, so exempt-authors is live rather
than a no-op.

Governance

Prepared under operator momentum delegation; standard veto
window applies — object on this PR before merge.

Closes #684

Related

• ci(pr-issue-linkage): exempt dependabot[bot] from the body gate #748 (superseded by this PR — blocked by required_signatures; see
  close comment for detail)
• Upstream reusable change: pr-issue-linkage: exempt bot-authored PRs (dependabot/renovate) via a login-allowlist input ci-workflows#149 (request),
  feat(pr-issue-linkage): add exempt-authors opt-in for bot PRs ci-workflows#171 (implementation, merged)
• Follow-up: Bump pr-issue-linkage pins across consumers after the bot-author exemption lands ci-workflows#157 (bump this pin across
  other consumers)
• chore(deps-dev): bump @anthropic-ai/claude-code from 2.1.214 to 2.1.215 in the npm-minor-patch group across 1 directory #669 (dependabot PR currently unmergeable without this exemption)

[claude]

Claude finished @kyle-sexton's task in 47s —— View job

---

PR Review

• Gather context and diff
• Read changed file
• Review for correctness, security, and CLAUDE.md alignment

---

Verdict: Approve — clean, minimal, correct change.

What changed

.github/workflows/pr-issue-linkage.yml:

1. SHA pin bumped from 90f1c54… → d7734df… (merge SHA of ci-workflows#171, which ships exempt-authors support)
2. exempt-authors: 'dependabot[bot]' added as an input
3. Inline comment added explaining why the exemption is needed

---

Correctness ✅

The pin bump is correctly sequenced — without it, passing exempt-authors would be a no-op (or rejected as an unknown input). The PR body confirms the upstream PR (ci-workflows#171) is merged, so the input is live at this SHA. The inline comment explains the "why" clearly, which is non-obvious and appropriate.

Security ✅

• Full 40-character SHA pin retained — no mutable ref introduced.
• permissions: {} is preserved at both the workflow and job levels — no privilege escalation.
• The exemption is narrowly scoped to a single trusted bot login; it doesn't widen bypass to human authors or other bots.
• pull_request_target + permissions: {} + no head-code execution — no new attack surface.

Conventions ✅

• PR title follows Conventional Commits (ci(pr-issue-linkage): …).
• Branch name follows <type>/<description> (feat/pr-issue-linkage-exempt-dependabot-signed).
• PR body carries Closes #684 and a populated ## Related section — passes the very gate this change is about.
• SHA comment format (# d7734df 2026-07-20) is consistent with the prior entry it replaces.

No issues found

The change is minimal, scoped only to what's needed, and well-justified. Nothing to flag.

[claude]

Claude finished @kyle-sexton's task in 1m 30s —— View job

---

Security Review — PR #754

Scope: .github/workflows/pr-issue-linkage.yml — two changes: (1) pin bumped from 90f1c54… → d7734df…, (2) exempt-authors: 'dependabot[bot]' input added.

---

Supply-chain risk — pin bump

Severity: SUGGESTION | Confidence: medium

The new pin d7734df8c557084edc2df7cf578cf62ad2f261e4 is a full 40-character commit SHA against a first-party org workflow — the correct pinning pattern, and substantially better than a mutable tag or branch ref. The PR claims this is the merge commit of melodic-software/ci-workflows#171.

Verification step needed: I cannot independently confirm from this environment that the SHA resolves to exactly that PR's merge commit and nothing else. A reviewer should run gh api repos/melodic-software/ci-workflows/commits/d7734df8c557084edc2df7cf578cf62ad2f261e4 and confirm the commit message / parent SHA matches the ci-workflows#171 merge before approving. For same-org first-party dependencies the blast radius is limited, but the practice of verifying claimed SHAs should be maintained.

No other supply-chain risk is present: the diff does not loosen a previously pinned dependency or introduce a new external action reference.

---

Authorization bypass via exempt-authors

No finding. The exempt-authors value is the hardcoded string literal 'dependabot[bot]' — it is not interpolated from any user-controlled GitHub context variable. The exemption is enforced in the reusable workflow by checking github.actor (or github.event.pull_request.user.login), both of which are set by GitHub's own infrastructure and cannot be spoofed by a PR contributor. A human cannot open a PR that appears to GitHub as authored by dependabot[bot].

---

pull_request_target with untrusted code / secrets

No finding. The use of pull_request_target is unchanged from the base branch. The existing workflow-level annotation and header comment correctly describe the rationale: the reusable reads only PR body metadata from the event payload and executes no head-branch code. Critically:

• permissions: {} at both the workflow and job level — no GITHUB_TOKEN capabilities granted.
• No secrets: inherit and no secrets: block — zero secrets passed to the reusable.

This PR does not regress either posture.

---

Script injection

No finding. There is no run: block anywhere in this file. The entire job is a uses: call with a with: block containing only a static string literal. There is no ${{ github.* }} interpolation in any run: context.

---

Permission widening

No finding. permissions: {} is unchanged at both levels.

---

Summary

One verification-step suggestion on confirming the claimed commit SHA; no exploitable security vulnerabilities found. The pull_request_target posture, secrets handling, permission grants, and injection surface are all unchanged and sound. The exemption logic is correctly scoped to a bot actor that cannot be impersonated by contributors.