[mrz1836]

What Changed

• Added DEPENDABOT_AUTO_MERGE_PATCH_THIRD_PARTY = true (.github/env/20-workflows.env)
• GO_PRE_COMMIT_VERSION: v1.13.0 → v1.13.1 (.github/env/10-pre-commit.env)
• GO_PRE_COMMIT_GOLANGCI_LINT_VERSION: v2.14.0 → v2.15.0 (.github/env/10-pre-commit.env)
• GOVULNCHECK_GO_VERSION: 1.27.2 → 1.27.3 (.github/env/00-core.env)
• MAGE_X_VERSION: v1.29.0 → v1.29.4 (.github/env/10-mage-x.env)
• MAGE_X_GOLANGCI_LINT_VERSION: v2.14.0 → v2.15.0 (.github/env/10-mage-x.env)
• Added a new auto-merge-trigger.yml workflow with no permissions or secrets. It queues the privileged auto-merge workflows through workflow_run. The existing auto-merge-on-approval.yml, dependabot-auto-merge.yml and pull-request-management.yml workflows were substantially reworked, and a new auto-merge GitHub App doc was added. Workflow docs and the workflow conventions guide were also updated.
• Issue templates (bug_report.yml, question.yml) now carry a "do not include secrets" warning. The bug report label changed from bug-p3 to bug-P3, and the Go version placeholder now reads "output of go version".
• .goreleaser.yml release prerelease changed from "false" to auto, and the setup-goreleaser action's GoReleaser action pin was updated from v7.2.3 to v7.3.0.
• CODEOWNERS changed the .github/actions pattern to .github/actions/ and dropped the .cursorrules entry. Smaller edits were also made to .devcontainer.json, SECURITY.md, and other docs and conventions files.

Why It Was Necessary

• Pull request automation needs an unprivileged entry point that hands off to privileged workflows running from the default branch. This avoids relying on pull_request_target, which GitHub disables by default on public repositories without an Actions event policy allowing it.
• Dependabot auto-merge needed a configurable rule for third-party patch updates, with documentation of the recommended supply-chain control (Dependabot cooldown).
• This keeps the repository's shared configuration, tooling versions, templates and docs aligned with the upstream source.

Testing Performed

• Reviewed the diff to confirm the changes are limited to workflow files, env configuration, issue templates, docs, and config files.
• Checked that the new trigger workflow's job names match the names the consumer workflows look for.
• CI checks on the PR will exercise the updated workflows and tooling versions.

Impact / Risk

• Moderate: the auto-merge, Dependabot, and PR management workflows were heavily rewritten. Auto-merge behavior may change, and the new third-party patch auto-merge setting defaults to true, so those PRs may now merge automatically.
• The auto-merge workflows depend on the new trigger workflow and on branch rulesets that dismiss stale approvals on push. Misconfiguration could stop auto-merge from arming.
• Tool version bumps (pre-commit, golangci-lint, MAGE-X, govulncheck Go version) could change lint or CI results. Setting prerelease: auto changes how releases are flagged.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud