[renovate]

This PR contains the following updates:

Package	Type	Update	Change
conforma/github-workflows	workflow	digest	ec01494 → 51213ed

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: b0762eb8-409a-4d17-a510-93bb7ded4339

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Routine bot-authored digest update to a CI workflow file; the protected path and CI change flags elevate Tier 1 above baseline, but git history confirms this is a repeated, low-risk maintenance pattern.

[fullsend-ai-review]

Looks good to me

---

Protected paths detected — this PR modifies files under one or more
protected paths. The review agent cannot approve PRs that touch these paths.
A human reviewer must approve this PR.

Protected files in this PR:

• .github/workflows/auto-merge.yaml

[fullsend-ai-retro]

Retro summary

PR #269 was a Renovate-authored one-line digest bump of conforma/github-workflows in .github/workflows/auto-merge.yaml. The fullsend pipeline behaved exactly as designed for this class of change: triage/code/fix/prioritize were correctly skipped, the risk-assessment agent scored it moderate (2/5) with the right rationale (routine bot digest bump in a protected path), and the review agent posted Looks good to me but withheld approval because the file is on the protected-path list. Renovate's own auto-merge later merged the PR without a fullsend-ai-review approval. There were no review iterations, no human change requests, no fix dispatches, and no CI failures.

Observed issues, all already filed

Every meaningful improvement angle for this run is already covered by existing open issues in fullsend-ai/fullsend. Filing new issues would be duplicative:

• Protected-path high-severity on bot digest bumps in .github/ — exactly the pattern on this PR. Already covered by #5370 ("distinguish mechanical version bumps from governance changes in .github/") and #3164 ("downgrade protected-path for platform bot managed-file updates"). PR Update conforma/github-workflows digest to 51213ed (main) #269 is a clean additional data point: review agent said the change is fine, but could not approve; the human-review request produced no human action and Renovate auto-merged anyway, so the gate acted as noise rather than as a safety control.
• Multiple parallel dispatch runs on PR open — three dispatch / Route + Harness dispatch jobs fired at 00:55:33 for the same PR-open event (runs 38329634464, 38329634548, 38329634640). Already covered by #8356 ("Dispatch workflow fans out to N parallel pull_request_target runs on PR open").
• Retro / full pipeline running at all for auto-merged bot digest PRs — the retro you are reading cost tokens on a change that is already understood to be mechanical. Already covered by #3647, #3317, #4989, and #5067.

No new proposals are being filed — per retro-filing-policy, evidence corroborating existing open issues belongs in this summary rather than in new "Evidence for #XXXX" issues.

Agents repo discovered from the run log: fullsend-ai/agents (review harness base at ce2eedd).