[karlspace]

Why

Dependabot opens weekly NuGet update PRs here (#10, #13 and #15 are open right now), and dotnet-release.yml already builds, tests and packs each of them on the PR. But the repository had no caller of the shared docker-maintenance-dependabot.yml workflow, so nothing decided on them: every PR waited for a manual merge, and nothing recorded which ones were safe to merge.

What

New .github/workflows/dependabot-maintenance.yml, which calls bauer-group/automation-templates/.github/workflows/docker-maintenance-dependabot.yml@main (based on the own-build-and-test-workflow.yml example):

• No paths: filter. Every Dependabot PR reaches the module, whatever its ecosystem, and gets an explicit decision: it is either merged or left open with an annotation and a job summary. types: [opened, synchronize, reopened, ready_for_review].
• required-workflows: .github/workflows/dotnet-release.yml. Its pull_request run builds BAUERGROUP.Shared.Business.Models.slnx, runs the tests (🔨 Build & Test) and packs the libraries with package validation (📋 Validate Package (PR)). That run must conclude success.
• dotnet-release.yml is unchanged. Its PR paths: (src/**, tests/**, *.slnx, Directory.Build.props, Directory.Packages.props) already cover every file the NuGet updater changes in this repository. The repository uses central package management, so Dependabot writes Directory.Packages.props, or a VersionOverride in a csproj under src/ or tests/. All 15 Dependabot PRs so far touched only Directory.Packages.props, and every one of them started the release workflow. There is no packages.lock.json or dotnet-tools.json, global.json has no msbuild-sdks, and Dependabot never writes nuget.config.
• merge-update-types: patch, merge-method: squash, auto-approve: true, secrets: inherit.
• Permissions: contents: write, pull-requests: write, checks: read, statuses: read, actions: read.

Compatibility

• NuGet: a patch update that dotnet-release.yml built, tested and packed successfully is merged automatically. Minor and major updates stay open for review. Under the 0.x rule a 0.y.z minor or a 0.0.z patch counts as major, and in a grouped update the strictest dependency decides.
• GitHub Actions: these updates, and any PR that changes .github/, are never merged automatically (the module's own guard). They get a notice and stay open for a manual merge.
• Releases: the NuGet commit prefix is deps(dotnet). .github/config/release/semantic-release.json sets no releaseRules, so the default rules (feat/fix/perf/revert/refactor) apply and a merged update cuts no NuGet release on its own; it ships with the next feat/fix release. The prefix is left unchanged on purpose. The merge is made with GITHUB_TOKEN, which starts no push workflow anyway.
• This PR only adds a file under .github/. The release workflow's push trigger ignores .github/**, so merging this PR cuts no release.

Known blocker, not changed here: 📋 Validate Package (PR) fails on every PR

Every pull_request run of dotnet-release.yml so far concluded failure (26 runs since 14 June, all from Dependabot). Five failed in 🔨 Build & Test (real build or test breaks of the update, e.g. #15). The other 21 passed 🔨 Build & Test and failed in 📋 Validate Package (PR) / 🏗️ Build & Pack; in the 10 most recent of them (since 19 July) the cause below is in the log (older logs show an earlier, since-fixed version extraction error or are no longer readable), e.g. run 37183456654 on #13 and run 37183332830 on #10. The pr-validate job packs unsigned: it sets no sign-assembly, and DOTNET_SIGNKEY_BASE64 is not available to Dependabot PRs anyway ("Assembly signing disabled (no signing key available)"). Package validation then compares against the signed 2.0.0 baseline (PackageValidationBaselineVersion in Directory.Build.props) and fails with CP0003 ("assembly public key token '9abfc39dbb2dd76a' does not match ... 'null'"), 15 times per run.

Until that is fixed, this caller merges nothing: every NuGet PR stays open with "CI did not pass", which is the safe outcome. Fixing it is a separate decision with trade-offs:

1. Make the signing key available to PR builds (add DOTNET_SIGNKEY_BASE64 as a Dependabot secret, set sign-assembly: true on pr-validate). The key is then exposed to the build of third-party package updates.
2. Skip only the baseline comparison for unsigned builds (e.g. make PackageValidationBaselineVersion conditional on the key file existing). The compatible-framework check still runs, and the release build (signed) keeps the full baseline check.
3. Suppress CP0003 for the unsigned-vs-signed case in CompatibilitySuppressions.xml.

Test

• The YAML parses, and the inputs and permissions were checked against the reusable workflow's workflow_call interface on automation-templates@main.
• The PR CI on this branch runs the new caller. Its reusable job is skipped by the module's job filter because this PR is not from Dependabot, which shows that GitHub accepts the caller (no startup failure). dotnet-release.yml does not run here, because this PR changes only .github/. The first Dependabot PR that is opened, reopened or rebased after the merge exercises the full decision path.

[github-actions]

🎉 This PR is included in version 2.2.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀