agents: add composite action dependabot, secret PR, and merge queue rules

.agents/rules/github_actions_workflows.md

@@ -1,12 +1,23 @@
 ---
 name: github-actions-workflows
 trigger: glob
-globs: ".github/workflows/**,.github/actions/**"
+globs: ".github/workflows/**,.github/actions/**,.github/dependabot.yml"
 ---
 
 # GitHub Actions Workflows Rule
 
-* Use the latest version of referenced actions in `.github/workflows/`.
+* Use the latest version of referenced actions in `.github/workflows/` and
+  `.github/actions/` (ensuring actions target supported Node.js runtimes such as
+  `node24` rather than deprecated `node20`).
+* **Dependabot Coverage for Composite Actions**: When adding a composite action
+  directory under `.github/actions/<name>`, add `"/.github/actions/<name>"` to
+  the `github-actions` `directories` list in `.github/dependabot.yml` (since
+  `directory: "/"` only scans `.github/workflows/`).
+* **Verifying Secret-Gated Workflow Steps**: GitHub Actions does not expose
+  repository secrets (e.g. `secrets.BUILDBUDDY_CAS_ONLY_KEY`) to `pull_request`
+  runs from forks (`origin`). To test secret-gated workflow or composite action
+  steps in CI, push the branch to `upstream` and open the PR from
+  `bazel-contrib:<branch>`.
 * **Use Local Composite Actions (`./.github/actions/setup-bazel`)**: Always use
   local composite action wrappers (such as
   `uses: ./.github/actions/setup-bazel`) instead of invoking upstream actions

.agents/skills/merge-pr/SKILL.md

@@ -15,6 +15,8 @@ this PR", or monitor its merge):
      "merge immediately" once CI passes and only `REVIEW_REQUIRED` blocks).
      Never pass `--admin` while CI is pending or failing unless told to bypass
      CI.
+   - **No `--delete-branch` (`-d`)**: Never pass `-d` or `--delete-branch` to
+     `gh pr merge`; it fails when a merge queue is enabled on the repository.
 2. **Invoke a Background Shepherd**: Launch a background subagent with the role
    `Merge PR Shepherd` to continuously watch the PR until it merges.
 3. **Leverage Existing CI Skills**:

.agents/skills/review-code/review-workflows-prompt.md

@@ -8,7 +8,10 @@ project's workflow rules and conventions:
 2. Verify executable permissions: any script invoked directly as a workflow
    step (e.g. `.github/workflows/*.py`, `*.sh`) must have `chmod +x` (filemode
    `100755`) and an appropriate shebang (e.g. `#!/usr/bin/env python3`).
-3. Verify action versions: ensure workflow steps use the latest action versions.
+3. Verify action versions and Dependabot coverage: ensure steps in
+   `.github/workflows/**` and `.github/actions/**` use the latest action
+   versions, and verify every `.github/actions/<name>` directory is listed under
+   `github-actions` `directories` in `.github/dependabot.yml`.
 4. Verify fallback jobs: ensure `suppress-no-jobs-ran-error` / `noop` fallback
    jobs exist in conditional workflows.
 5. Check event payload handling: for steps that are a single Python script,