[cbetta]

Reviewer check	This PR
Auth / permissions	No
Data access widened	No
New secret, env var or key	No
CI, deploy or infra	Yes: the CI merge job's rule for Dependabot image updates
Dependencies	No

A follow-up to the merge job's digest-refresh fix. Copilot showed previous-version can't be trusted for this: it covers only the first image of a grouped update, a date tag like 20261023 looks like a digest, and a single-image refresh leaves it empty. The rule now reads the PR's diff and merges only when every changed line differs in nothing but its @sha256 digest:

old="$({ grep '^-[^-]' <<< "$diff" || true; } | sed -E 's/^-//; s/@sha256:[0-9a-f]{64}//g' | sort)"
new="$({ grep '^+[^+]' <<< "$diff" || true; } | sed -E 's/^\+//; s/@sha256:[0-9a-f]{64}//g' | sort)"
if [ -n "$old" ] && [ "$old" = "$new" ]; then merge=true; ...

Checked: a digest-only refresh merges; a tag change, a grouped update with a tag change, a date-tag change and an empty diff all wait. actionlint (shellcheck) passes.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

The comparison can approve digest-pin removal and non-digest changes that cancel across files or positions.

2 open issues

• Digest pin removal is incorrectly treated as equivalent · New
• Cross-file sorting hides unrelated Dockerfile changes · New

What changed in this PR

This PR changes the CI auto-merge gate to identify Dependabot image digest refreshes from the PR diff rather than unreliable version metadata.

Changes:

• Removes the previous-version input from the merge decision.
• Compares digest-normalized changed lines, including grouped image updates.
• Updates the explanation for changes that require manual review.

File	Description
.github/​workflows/​ci.yml	Replaces metadata-based digest detection with a diff-based auto-merge check.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The merge gate can authorize updates after content-fetch failures and still overlooks non-digest changes.

3 open issues

• Missing pipefail allows failed content checks to authorize merges · New
• Executable mode changes bypass digest-only merge validation · New
• Trailing newline changes are ignored during content comparison · New

2 resolved since last review

• Cross-file sorting hides unrelated Dockerfile changes
• Digest pin removal is incorrectly treated as equivalent

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Successful API responses that omit large-file contents can still authorize non-digest changes.

1 open issue

• Reject Contents API responses with unsupported encoding · New

3 resolved since last review

• Missing pipefail allows failed content checks to authorize merges
• Trailing newline changes are ignored during content comparison
• Executable mode changes bypass digest-only merge validation

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The revised gate addresses the prior issues, and the supplied verification supports rejecting non-digest changes and lookup failures.

No open issues 🎉

1 resolved since last review

• Reject Contents API responses with unsupported encoding

_{Review effort: Balanced}