ci: settle on merge-after-approval, and stop floating a ruleset bypass

The comments and the skip message offered "or a ruleset bypass actor for this
workflow" as though the decision were still open. It is not: main's ruleset keeps
its code-owner approval requirement and gains no bypass actor, because unattended
merging would mean granting some identity the right to bypass code-owner review on a
public repository, which is not a trade worth making for dependency bumps in demo
applications. A bot approval could not satisfy a CODEOWNERS requirement anyway.

Behaviour is unchanged — the merge is still attempted and the outcome classified,
which is simpler than mirroring the ruleset's configuration in the script and cannot
drift from it. The skip message for the ordinary case now reads as a worklist entry:
"ready to merge, awaiting a code-owner approval (@aws/aws-lambda-tooling)".

What the workflow is worth without unattended merging: approve once and the merge
happens within the hour, but only when the verification covers the exact commit that
lands, so a stale approval cannot merge an unverified head. The hourly sweep is what
makes approving a batch and walking away work.

Six paths re-run, all unchanged.

Author: bnusunny

.github/scripts/dependabot-automerge.sh

@@ -3,13 +3,16 @@
 # Merges one Dependabot pull request, if it is an example-only update that Verify Examples
 # has verified at the pull request's current head.
 #
-# Whether that merge is unattended depends on main's ruleset, not on this script. The
-# ruleset currently requires one code-owner approval and lists no bypass actors, so the
-# merge is refused until a human approves and the refusal is reported as exactly that.
-# Making this workflow's identity a bypass actor turns the same code into unattended
-# auto-merge, with the guards below as the only thing standing between a bump and main —
-# which is why they are what they are: example-only, verified at this exact head, every
-# check green.
+# It merges after a human approves; it never merges unattended, and it never approves
+# anything itself. main's ruleset requires one code-owner approval
+# (.github/CODEOWNERS assigns `*` to @aws/aws-lambda-tooling) with no bypass actors, and
+# that was left alone deliberately — unattended merging would mean granting some identity
+# the right to bypass code-owner review on a public repository, which is not a trade worth
+# making for dependency bumps in demo applications.
+#
+# What it removes is the second trip: approve once and the merge happens within the hour,
+# but only when the verification covers the exact commit that lands, so a stale approval
+# cannot merge an unverified head.
 #
 # Usage: REPO=<owner/repo> dependabot-automerge.sh <pr-number>
 #
@@ -166,11 +169,9 @@ if [[ -n "$unverified" ]]; then
   skip "in the matrix but not verified by run $run_id: $(join_list "$unverified")"
 fi
 
-# Deliberately no approval gate of its own: the merge is attempted and the outcome
-# classified below. That way this one script behaves correctly whichever way main's
-# ruleset is configured — it merges unattended where the workflow is a bypass actor, and
-# reports "waiting for a code-owner approval" where it is not, with no toggle to keep in
-# sync with a repository setting it cannot see.
+# No approval gate of its own: the merge is attempted and the outcome classified below.
+# The ruleset is the authority on whether a merge may happen, so asking it is both simpler
+# than mirroring its configuration here and impossible to get out of sync with.
 review=$(jq -r '.reviewDecision // "NONE"' <<<"$pr_json")
 echo "PR #$PR is example-only and verified at $head_sha by run $run_id (reviewDecision=$review). Merging."
 
@@ -208,10 +209,9 @@ case "$state" in
   # reported as "a sibling update landed first", which was simply the wrong diagnosis:
   # main's ruleset blocks a merge until the required review is satisfied.
   BLOCKED)
-    # main's ruleset requires one code-owner approval (.github/CODEOWNERS assigns `*` to
-    # @aws/aws-lambda-tooling) and lists no bypass actors, so this is the expected
-    # outcome until either a human approves or this workflow's identity is made a bypass
-    # actor. Named precisely, because it used to be reported as a sibling conflict.
+    # The expected outcome for an unapproved pull request: main's ruleset requires a
+    # code-owner approval. Named precisely, because it used to be reported as a sibling
+    # conflict, which it never was.
     case "$review" in
       APPROVED)
         skip "merge rejected, blocked by main's ruleset even though it is approved — a required rule is unsatisfied."
@@ -220,7 +220,7 @@ case "$state" in
         skip "merge rejected, a reviewer requested changes."
         ;;
       *)
-        skip "verified at ${head_sha:0:8} by run $run_id — blocked awaiting a code-owner approval (@aws/aws-lambda-tooling), or a ruleset bypass actor for this workflow."
+        skip "verified at ${head_sha:0:8} by run $run_id — ready to merge, awaiting a code-owner approval (@aws/aws-lambda-tooling)."
         ;;
     esac
     ;;

.github/workflows/dependabot-automerge.yaml

@@ -3,11 +3,15 @@ name: Dependabot Merge
 # Merges Dependabot pull requests that only touch example applications, once a code owner
 # has approved them and Verify Examples has verified them.
 #
-# Deliberately not "auto-merge on green": main is governed by a ruleset with one required
-# code-owner approval and zero bypass actors, so no token here can merge without a human,
-# and a bot approval cannot satisfy a CODEOWNERS requirement. The value is in the other
-# half — an approval no longer means "and come back later to click merge", and the merge
-# only happens if the verification covers the exact commit that lands. The decision lives in
+# Deliberately not "auto-merge on green". main's ruleset requires one code-owner approval
+# and has no bypass actors, and that was a considered choice rather than an obstacle:
+# unattended merging would mean giving some identity the right to bypass code-owner review
+# on a public repository, which is not worth it for dependency bumps in demo apps. A bot
+# approval could not satisfy a CODEOWNERS requirement anyway.
+#
+# The value is the other half — an approval no longer means "and come back later to click
+# merge", and the merge only happens if the verification covers the exact commit that
+# lands. The decision lives in
 # .github/scripts/dependabot-automerge.sh; this file only decides which pull requests to
 # offer it.
 #