[hassiebp]

Refs LFE-18002.

Removes .github/workflows/dependabot-rebase-stale.yml. On every push to main, it rebased open Dependabot PRs via orange-buffalo/dependabot-auto-rebase, authenticated with a personal access token stored in the DEP_REBASE_PAT repo secret.

DEP_REBASE_PAT has no other users: a repo-wide grep (including all of .github/workflows/) finds no other reference.

Also removes rebase-strategy: "disabled" from .github/dependabot.yml so Dependabot's built-in rebasing takes over. There were two such lines, under the uv ecosystem (with a # use dependabot-rebase-stale comment) and under github-actions. Both are removed because the deleted workflow rebased PRs from both ecosystems.

After merge (Max):

• Delete the DEP_REBASE_PAT repository secret.
• Revoke the underlying personal access token.

Verification: rg -n DEP_REBASE_PAT and rg -n rebase .github/ both return nothing. .github/dependabot.yml still parses as valid YAML. No code changed, so no tests were run.

  

Confidence Score: 5/5

The PR appears safe to merge with the acknowledged loss of automatic Dependabot rebasing.

Summary

Removes .github/workflows/dependabot-rebase-stale.yml, which used DEP_REBASE_PAT to rebase Dependabot PRs after pushes to main.

• Dependabot pull requests are no longer rebased by this workflow.

_{Reviews (1) · Last reviewed commit: "ci: remove dependabot rebase workflow us..." · Reviewed by Greptile}

[github-actions]

@claude review

[claude]

Claude Code Review

No review was started: this request came from a bot account. Manual reviews can only be requested by someone with write access to this repository. Ask a maintainer to comment @claude review, or have your automation post the comment from a user account with write access.

_{Tip: disable this comment in your organization's Code Review settings.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T13:13:48.888460Z	661220c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 661220cf97

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

Additional findings (outside the current diff — GitHub can't attach inline comments there):

• 🟡 .github/workflows/dependabot-rebase-stale.yml — After merging, Dependabot PRs for both ecosystems are never rebased, so they go stale and conflict on uv.lock until someone rebases them by hand. .github/dependabot.yml:14 and :34 still set rebase-strategy: "disabled", which relied on this workflow. Line 14's comment # use dependabot-rebase-stale now names a deleted workflow. Fix: in this same PR, drop rebase-strategy: "disabled" from both updates entries in .github/dependabot.yml, along with the stale comment. Dependabot's built-in rebasing then takes over without any PAT.

  Why this was flagged

  The deleted workflow ran on every push to main and rebased all open Dependabot PRs using orange-buffalo/dependabot-auto-rebase. .github/dependabot.yml:14 (uv) and .github/dependabot.yml:34 (github-actions) both set rebase-strategy: "disabled", and line 14's comment says that is because this workflow does the rebasing. Once both are merged, nothing rebases Dependabot PRs. Each merge to main leaves the open daily uv and github-actions PRs behind, often with uv.lock conflicts, so maintainers have to rebase or recreate them by hand. On the base branch the workflow did this on every push. The PR description calls this a known follow-up. But the fix only touches config, needs no PAT, and fits inside this change, so the regression does not have to ship.

  Verification: Trigger: any merge to main while uv or github-actions Dependabot PRs are open. The diff deletes .github/workflows/dependabot-rebase-stale.yml, which rebased open Dependabot PRs on push to main. .github/dependabot.yml still has rebase-strategy: "disabled" on line 14 and line 34, so nothing rebases those PRs and they can conflict on uv.lock. It is a regression in automation that works on the base branch.