Make CI checks truthful and harden benchmark publication

.codacy.yml

@@ -0,0 +1,4 @@
+---
+# Immutable downloaded logs and template snapshots are evidence, not maintained source.
+exclude_paths:
+  - 'dev/log/**'

.github/actions/prepare-ci/action.yml

@@ -0,0 +1,27 @@
+name: Prepare CI merge
+description: Merge the current PR base into the checked-out revision
+inputs:
+  base-sha:
+    description: Replay a previously validated base commit for benchmark matrix consistency
+    required: false
+outputs:
+  base-sha:
+    description: Base commit used for this merge
+    value: ${{ steps.merge.outputs.base }}
+runs:
+  using: composite
+  steps:
+    - name: Merge current base for pull requests
+      id: merge
+      if: github.event_name == 'pull_request'
+      shell: bash
+      env:
+        BASE_REF: ${{ github.base_ref }}
+        BASE_SHA: ${{ inputs.base-sha }}
+      run: |
+        git config user.email 'github-actions[bot]@users.noreply.github.com'
+        git config user.name 'github-actions[bot]'
+        git fetch origin "$BASE_REF"
+        base="${BASE_SHA:-origin/$BASE_REF}"
+        echo "base=$(git rev-parse "$base")" >> "$GITHUB_OUTPUT"
+        git merge --no-edit "$base"

.github/dependabot.yml

@@ -1,16 +1,37 @@
 version: 2
 updates:
 - package-ecosystem: nuget
-  directory: "/csharp"
+  directories:
+    - "/csharp"
+    - "/experiments/csharp_objects_profile"
+    - "/experiments/csharp_split_linked_list"
+    - "/experiments/csharp_tree_delete"
+    - "/experiments/system_data_sqlite"
   schedule:
     interval: daily
   open-pull-requests-limit: 10
+  cooldown:
+    default-days: 7
 - package-ecosystem: cargo
-  directory: "/rust"
+  directories:
+    - "/rust"
+    - "/experiments/unit_store_growth"
+    - "/experiments/sqlite_returning"
+    - "/experiments/split_store_delete"
   schedule:
     interval: daily
   open-pull-requests-limit: 10
+  cooldown:
+    default-days: 7
 - package-ecosystem: github-actions
   directory: "/"
   schedule:
     interval: weekly
+  cooldown:
+    default-days: 7
+- package-ecosystem: pip
+  directory: "/scripts"
+  schedule:
+    interval: weekly
+  cooldown:
+    default-days: 7

.github/workflows/AutoMerge.yml

@@ -1,14 +1,34 @@
 name: auto-merge
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] metadata only; no checkout or PR code execution
+    types: [opened, reopened, synchronize]
+
+permissions:
+  contents: read
 
 jobs:
   auto-merge:
-    runs-on: ubuntu-latest
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: write
+      pull-requests: write
+    concurrency:
+      group: main-writer-${{ github.repository }}-main
+      cancel-in-progress: false
     steps:
-      - uses: actions/checkout@v7
-      - uses: ahmadnassri/action-dependabot-auto-merge@v2
+      # Action updates can use v1/v2 titles which the old parser rejected.
+      - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3
+        id: metadata
         with:
-          target: minor
-          github-token: ${{ secrets.DEPENDABOT_AUTO_MERGE_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Enable auto-merge for patch and minor updates
+        if: >-
+          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
+          steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        env:
+          GH_TOKEN: ${{ secrets.DEPENDABOT_AUTO_MERGE_TOKEN || github.token }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: gh pr merge --auto --squash "$PR_URL"