Compliance: allow_auto_merge

[don-petry]

Compliance Finding

Category: settings
Severity: warning
Check: allow_auto_merge

Detail

Allow auto-merge must be enabled for Dependabot workflow (current: null, expected: true)

Standard Reference

standards/github-settings.md#repository-settings--standard-defaults

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

---

This issue was automatically created by the weekly compliance audit.

[don-petry]

Weekly Compliance Audit (2026-04-09)

This finding is still open.

Detail: Allow auto-merge must be enabled for Dependabot workflow (current: null, expected: true)

Standard: standards/github-settings.md#repository-settings--standard-defaults

[don-petry]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[don-petry]

Weekly Compliance Audit (2026-04-10)

This finding is still open.

Detail: Allow auto-merge must be enabled for Dependabot workflow (current: null, expected: true)

Standard: standards/github-settings.md#repository-settings--standard-defaults

[don-petry]

Claude finished @don-petry's task in 3m 31s —— View job • claude/issue-89-20260414-1249 • [Create PR ➔](https://github.com/petry-projects/markets/compare/main...claude/issue-89-20260414-1249?quick_pull=1&title=Issue%20%2389%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%2389%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

---

Compliance Fix: allow_auto_merge

• Gather context — read standards and fetch workflow template
• Verify repository settings (already compliant)
• Verify dependabot-automerge.yml workflow (already present, matches template verbatim)
• Commit confirmation and push branch
• Open pull request — PR #103
• Tag CODEOWNERS for review

Summary

Both compliance requirements were already satisfied:

Check	Status
allow_auto_merge repository setting	✅ true
.github/workflows/dependabot-automerge.yml	✅ exists, matches org template verbatim

The setting was enabled by a previous automated run. PR #103 creates a formal tracking commit so the issue can be closed on merge.

PR #103 ·

[don-petry]

Weekly Compliance Audit (2026-04-17)

This finding is still open.

Detail: Allow auto-merge must be enabled for Dependabot workflow (current: null, expected: true)

Standard: standards/github-settings.md#repository-settings--standard-defaults

[don-petry]

Claude finished @don-petry's task in 6m 54s —— View job • claude/issue-89-20260418-1841 • [Create PR ➔](https://github.com/petry-projects/markets/compare/main...claude/issue-89-20260418-1841?quick_pull=1&title=Issue%20%2389%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%2389%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

---

Compliance Fix: allow_auto_merge

• Gather context — checked API, PR compliance: confirm allow_auto_merge is enabled #103, org template
• Verify dependabot-automerge.yml workflow — present, matches org template verbatim
• Re-apply allow_auto_merge=true via GitHub API PATCH — confirmed true
• Create PR #122
• Tag CODEOWNERS for review

Summary

Both compliance requirements are satisfied:

Check	Status
allow_auto_merge repository setting	✅ true (re-applied via API)
.github/workflows/dependabot-automerge.yml	✅ exists, matches org template verbatim

Why the audit keeps reporting null

The compliance script uses ORG_SCORECARD_TOKEN to query gh api repos/petry-projects/markets. The allow_auto_merge field in the GitHub REST API is only visible to tokens with admin-level repository access. If ORG_SCORECARD_TOKEN is a PAT with public_repo scope (without administration read), the field returns null even though the setting is enabled — a false positive. To permanently resolve, the ORG_SCORECARD_TOKEN secret in petry-projects/.github should be audited for admin scope.

PR

PR #122 — compliance: confirm allow_auto_merge is enabled (closes #89)

Note: PR #103 (previous run) is also open with the same intent and can be closed as superseded.
· Branch