[sadjow]

Reviewer card

• Intent: stop Dependabot security PRs from stalling silently when CI rejects lockfile packages younger than pnpm's minimumReleaseAge (one day by default in pnpm 11).
• Non-goals: the release-age policy stays as it is. No trustLockfile, no minimumReleaseAgeExclude entries, and no change to the auto-merge workflow.
• Decisions for reviewers: a six-hourly schedule, a 24-hour wait after the failed attempt, and a cap of three attempts per run.
• Evidence: a dry run of the selection logic against real runs picked chore(deps-dev): bump nuxt from 4.5.2 to 4.6.2 #245's stuck run (39992995156, which failed on ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION), skipped chore(deps): update Nuxt, devtools, Vite, and node-forge to patched releases #246's passing run, and the log check rejected run 38804722699, which failed for another reason. actionlint (with shellcheck) and Prettier pass.
• Risk and reversibility: the job never checks out or runs PR code. It reads PR metadata and failed-job logs, and its token can only re-run workflows (actions: write). Deleting the file removes it.
• Open: the first scheduled run happens after merge; it can also be started manually through workflow_dispatch.

Problem

Dependabot skips its cooldown for security updates by design, so a security PR can resolve transitive packages published minutes earlier. pnpm install --frozen-lockfile re-verifies every lockfile entry against minimumReleaseAge, so every CI job fails even though the change is sound. Auto-merge then waits on checks that never re-run, and the PR sits open. That happened to #245. Upstream, Dependabot does not write minimumReleaseAgeExclude for these updates yet (dependabot/dependabot-core#13854).

Change

A scheduled workflow looks at each open Dependabot PR's latest CI run. When that run failed on the release-age check and finished more than a day ago, it re-runs the failed jobs. Because the lockfile is unchanged and its packages are now old enough, the re-run passes and the existing auto-merge completes. Failures for any other reason are left for review.