Fail closed on PR head drift before Dependabot auto-approve/merge

The Anthropic gate can wait up to 30 minutes while evaluating a specific
head SHA. Re-read the current PR head before approving or enabling
auto-merge, bind approvals to commit_id, and pass --match-head-commit so
an older workflow run cannot approve or queue merge for a newer commit.

Co-authored-by: Jonathan Kingston <jonathanKingston@users.noreply.github.com>

Author: cursoragent

.github/scripts/dependabot-anthropic-gate.mjs

@@ -50,6 +50,16 @@ function setOutput(name, value) {
     appendFileSync(outputPath, `${name}<<${delimiter}\n${value}\n${delimiter}\n`);
 }
 
+/**
+ * Fail closed when the PR head advanced after the gate started evaluating a
+ * specific commit. Approval and auto-merge must only act on the assessed SHA.
+ */
+export function assertPrHeadUnchanged({ currentHead, assessedHead }) {
+    if (currentHead !== assessedHead) {
+        throw new Error(`PR head advanced from ${assessedHead} to ${currentHead}; refusing to approve or auto-merge using stale evidence.`);
+    }
+}
+
 export function truncate(value, limit = MAX_BODY_CHARS) {
     if (!value) return '';
     if (value.length <= limit) return value;
@@ -552,6 +562,7 @@ async function main() {
     };
 
     const decision = await askAnthropic({ apiKey: anthropicApiKey, model, evidence });
+    setOutput('assessed_head_sha', headSha);
     setOutput('safe_to_merge', String(decision.safe_to_merge));
     setOutput('reason', decision.reason);
     setOutput('confidence', decision.confidence ?? 'unknown');

.github/scripts/dependabot-anthropic-gate.test.mjs

@@ -20,6 +20,7 @@ import {
     matchedCursorSources,
     evidenceForRun,
     parseAnthropicDecision,
+    assertPrHeadUnchanged,
     truncate,
     parseLinkHeader,
 } from './dependabot-anthropic-gate.mjs';
@@ -471,6 +472,28 @@ describe('truncate', () => {
     });
 });
 
+describe('assertPrHeadUnchanged', () => {
+    it('allows approval when the current head matches the assessed SHA', () => {
+        assert.doesNotThrow(() =>
+            assertPrHeadUnchanged({
+                currentHead: HEAD_SHA,
+                assessedHead: HEAD_SHA,
+            }),
+        );
+    });
+
+    it('fails closed when the PR head advanced after the gate assessment', () => {
+        assert.throws(
+            () =>
+                assertPrHeadUnchanged({
+                    currentHead: 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
+                    assessedHead: HEAD_SHA,
+                }),
+            /PR head advanced/,
+        );
+    });
+});
+
 describe('parseLinkHeader', () => {
     it('extracts the next-page URL from a GitHub Link header', () => {
         const header = '<https://api.github.com/x?page=2>; rel="next", <https://api.github.com/x?page=3>; rel="last"';

.github/workflows/dependabot-auto-merge.yml

@@ -69,19 +69,34 @@ jobs:
               env:
                   GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                   PR_NUMBER: ${{ github.event.pull_request.number }}
+                  PR_HEAD_SHA: ${{ steps.anthropic_gate.outputs.assessed_head_sha }}
                   REPO: ${{ github.repository }}
               run: |
                   set -euo pipefail
-                  gh pr review "$PR_NUMBER" --repo "$REPO" --approve || true
+                  current_head="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid')"
+                  if [[ "$current_head" != "$PR_HEAD_SHA" ]]; then
+                    echo "PR head advanced from $PR_HEAD_SHA to $current_head; refusing to approve using stale evidence."
+                    exit 1
+                  fi
+                  gh api "repos/$REPO/pulls/$PR_NUMBER/reviews" \
+                    --method POST \
+                    -f event=APPROVE \
+                    -f commit_id="$PR_HEAD_SHA" || true
 
             - name: Enable auto-merge for npm update
               if: steps.anthropic_gate.outputs.safe_to_merge == 'true'
               env:
                   GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                   PR_NUMBER: ${{ github.event.pull_request.number }}
+                  PR_HEAD_SHA: ${{ steps.anthropic_gate.outputs.assessed_head_sha }}
                   REPO: ${{ github.repository }}
               run: |
                   set -euo pipefail
+                  current_head="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid')"
+                  if [[ "$current_head" != "$PR_HEAD_SHA" ]]; then
+                    echo "PR head advanced from $PR_HEAD_SHA to $current_head; refusing to enable auto-merge using stale evidence."
+                    exit 1
+                  fi
 
                   merge_state="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json mergeStateStatus,isDraft --jq '.mergeStateStatus + " " + (if .isDraft then "draft" else "ready" end)')"
                   echo "merge_state=$merge_state"
@@ -99,7 +114,7 @@ jobs:
                       ;;
                   esac
 
-                  if ! out="$(gh pr merge "$PR_NUMBER" --repo "$REPO" --auto --merge 2>&1)"; then
+                  if ! out="$(gh pr merge "$PR_NUMBER" --repo "$REPO" --auto --merge --match-head-commit "$PR_HEAD_SHA" 2>&1)"; then
                     echo "Could not enable auto-merge for PR; leaving it unqueued."
                     echo "$out"
                     exit 0