ci: pin dependabot-automerge reusable workflow to SHA

[donpetry-bot]

Summary

• Pins the petry-projects/.github reusable workflow reference in dependabot-automerge.yml from @v1 to the corresponding commit SHA (0cb4bba11d7563bf197ad805f12fb8639e4879e4)
• Retains the # v1 comment for human readability
• Brings the repository into compliance with the action-pinning policy

Changes

File	Change
.github/workflows/dependabot-automerge.yml	Pinned uses: from @v1 to SHA 0cb4bba…

Test plan

• CI passes
• Compliance audit no longer flags dependabot-automerge.yml for action-pinning

Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated internal CI/CD workflow configuration for improved reliability and consistency.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 8adc6588-8657-4e4c-aef4-b350a9a3fda5

📥 Commits

Reviewing files that changed from the base of the PR and between 807229f and 0b7eff8.

📒 Files selected for processing (1)

• .github/workflows/dependabot-automerge.yml

---

📝 Walkthrough

Walkthrough

This PR pins the dependabot-automerge reusable workflow reference to a specific commit SHA instead of the @v1 semantic version tag to comply with action-pinning policy.

Changes

Workflow Reference Pinning

Layer / File(s)	Summary
Workflow Reference Pin .github/workflows/dependabot-automerge.yml	The uses: reference for the dependabot-automerge job was updated from petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1 to a pinned commit SHA 0cb4bba11d7563bf197ad805f12fb8639e4879e4.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related issues

• Compliance: unpinned-actions-dependabot-automerge.yml #116: Compliance: unpinned-actions-dependabot-automerge.yml — This PR directly resolves the compliance finding by pinning the unpinned reusable workflow reference to a commit SHA per the action-pinning-policy standard.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-116-20260511-1236

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud