Finding
The reusable auto-merge workflow verifies that real verification checks were actually reported, matching check names with endswith() against a list of accepted leaves. The osv entry accepts "osv scanner" and "osv-scan".
Three fleet repos name that job osv-scanner (hyphen, one word), which ends with neither: "osv-scanner" does not end with "osv scanner", and it does not end with "osv-scan" — it ends with "scanner".
Any of those repos adopting the reusable would hit No required verification check ending in any of: osv scanner osv-scan and refuse every dependabot auto-merge, on PRs whose osv check reported and passed.
Evidence
.github/workflows/dependabot-auto-merge.yml:60 — require_passed_check "osv scanner" "osv-scan"forkwright/akroasis.github/workflows/security.yml — name: osv-scannerforkwright/epistole.github/workflows/security.yml — name: osv-scannerforkwright/hamma.github/workflows/security.yml — name: osv-scannerforkwright/kanon.github/workflows/security.yml — name: osv scanner (matches today)
The file's own header states the premise this contradicts:
Required-check names are fleet-invariant because security.yml + gate-attestation.yml are canonical.
Measured across the four repos carrying a local copy of this workflow, they are not invariant: two spellings, split 3–1. The hyphenated one is the majority.
Why this matters
It fails CLOSED, so nothing merges that should not — but it blocks the migration path for exactly the repos that most need it. All three still carry a local copy whose guard exit 0s on failed checks, so their guard reports a refusal and then merges anyway (filed separately per repo).
The failure also misattributes itself. An adopter sees the shared workflow refuse a green PR and concludes the reusable is broken, rather than that one leaf string is missing — so the first repo to try adoption is likely to revert to its local copy and keep the defect.
Underneath both: an invariance asserted in a comment and enforced nowhere is the decay this very check exists to catch. The header makes the claim; nothing fails when it stops being true.
Desired correction
Accept the hyphenated spelling — either add "osv-scanner" to the leaf list, or match osv on contains("osv"), which is what the surrounding code already does in its workflow-name fallback for other repos.
Worth considering alongside it: the fleet-invariance claim in the header would be better as something that fails. A check that the reported check-name set across adopting repos matches the leaf list would have caught this before an adopter did.
Done when:require_passed_check matches a job named osv-scanner, and akroasis, epistole and hamma can adopt the reusable without auto-merge refusing on a reported-and-passing osv check.
Finding
The reusable auto-merge workflow verifies that real verification checks were actually reported, matching check names with
endswith()against a list of accepted leaves. The osv entry accepts"osv scanner"and"osv-scan".Three fleet repos name that job
osv-scanner(hyphen, one word), which ends with neither:"osv-scanner"does not end with"osv scanner", and it does not end with"osv-scan"— it ends with"scanner".Any of those repos adopting the reusable would hit
No required verification check ending in any of: osv scanner osv-scanand refuse every dependabot auto-merge, on PRs whose osv check reported and passed.Evidence
.github/workflows/dependabot-auto-merge.yml:60—require_passed_check "osv scanner" "osv-scan"forkwright/akroasis.github/workflows/security.yml—name: osv-scannerforkwright/epistole.github/workflows/security.yml—name: osv-scannerforkwright/hamma.github/workflows/security.yml—name: osv-scannerforkwright/kanon.github/workflows/security.yml—name: osv scanner(matches today)The file's own header states the premise this contradicts:
Measured across the four repos carrying a local copy of this workflow, they are not invariant: two spellings, split 3–1. The hyphenated one is the majority.
Why this matters
It fails CLOSED, so nothing merges that should not — but it blocks the migration path for exactly the repos that most need it. All three still carry a local copy whose guard
exit 0s on failed checks, so their guard reports a refusal and then merges anyway (filed separately per repo).The failure also misattributes itself. An adopter sees the shared workflow refuse a green PR and concludes the reusable is broken, rather than that one leaf string is missing — so the first repo to try adoption is likely to revert to its local copy and keep the defect.
Underneath both: an invariance asserted in a comment and enforced nowhere is the decay this very check exists to catch. The header makes the claim; nothing fails when it stops being true.
Desired correction
Accept the hyphenated spelling — either add
"osv-scanner"to the leaf list, or match osv oncontains("osv"), which is what the surrounding code already does in its workflow-name fallback for other repos.Worth considering alongside it: the fleet-invariance claim in the header would be better as something that fails. A check that the reported check-name set across adopting repos matches the leaf list would have caught this before an adopter did.
Done when:
require_passed_checkmatches a job namedosv-scanner, and akroasis, epistole and hamma can adopt the reusable without auto-merge refusing on a reported-and-passing osv check.