[Sync] Update project files from source repository (62f6f26)

[mrz1836]

What Changed

• MAGE_X_VERSION: v1.27.3 → v1.28.0 (.github/env/10-mage-x.env)

• MAGE_X_BENCHSTAT_VERSION_LATEST: v0.0.0-20260908200009-22c9c6c9d4da → v0.0.0-20260929162123-406019bb8b68 (.github/env/10-mage-x.env)

• GOVULNCHECK_GO_VERSION: 1.27.1 → 1.27.2 (.github/env/00-core.env)

• GO_PRE_COMMIT_VERSION: v1.11.0 → v1.13.0 (.github/env/10-pre-commit.env)

• Added DEPENDABOT_AUTO_MERGE_PATCH_SAME_OWNER = true (.github/env/20-workflows.env)

• Added same-owner dependency detection logic to the Dependabot auto-merge workflow, enabling automatic merging of patch updates for first-party production dependencies while requiring manual review for third-party patches

• Reordered JSON fields in t3.json to move "name" to the end of each script object (after "command" and "icon")

• Updated workflow comments and documentation to clarify the distinction between first-party and third-party production patch updates in the auto-merge rules

Why It Was Necessary

• Enables safer automation by distinguishing between internal and external production dependencies, allowing first-party patches to merge automatically while maintaining manual review requirements for third-party code
• Aligns with security best practices by applying stricter review requirements to external dependencies while reducing friction for internal module updates
• Synchronizes tooling versions and configurations to ensure consistent development environment and CI/CD behavior across the project

Testing Performed

• Automated file synchronization process validated the JSON syntax and structure changes in t3.json
• Environment variable updates in .github/env/ files follow existing patterns and will be validated by workflow schema checks
• The new same-owner detection logic in the Dependabot workflow includes fail-closed safeguards that default to requiring manual review when ownership cannot be verified

Impact / Risk

• Low Risk: Version bumps are minor/patch updates following semantic versioning; JSON field reordering has no functional impact
• Improved Security: Third-party production patches now require manual review by default, while first-party patches can auto-merge when all dependencies share the repository owner
• No Breaking Changes: All changes are backward-compatible configuration updates and workflow enhancements that preserve existing auto-merge behavior for dev dependencies and indirect updates

[Copilot]

🔵 Needs a closer look

Production dependency auto-merging is security-sensitive and warrants human validation against live Dependabot metadata and repository permissions.

0 open findings

What changed in this PR

Synchronizes tooling and Dependabot automation, introducing same-owner production patch auto-merging.

Changes:

• Updates Go, MAGE-X, benchstat, and go-pre-commit versions.
• Adds fail-closed same-owner dependency detection and auto-merge routing.
• Reorders t3.json fields without behavioral changes.

File	Description
.github/​env/​00-core.env	Updates govulncheck’s Go version.
.github/​env/​10-mage-x.env	Updates MAGE-X and benchstat.
.github/​env/​10-pre-commit.env	Updates go-pre-commit.
.github/​env/​20-workflows.env	Enables same-owner patch merging.
.github/​workflows/​dependabot-auto-merge.yml	Implements ownership verification and routing.
t3.json	Reorders script fields.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.