chore(ci): remove Dependabot, add Claude + Copilot code review

[srpatcha]

Dependabot removed

Dependabot is disabled across the organisation:

• .github/dependabot.yml deleted here
• Dependabot alerts and automated security fixes turned off via the API on all 26 repositories
• 90 open Dependabot PRs closed org-wide

Important

Disabling alerts also stops CVE notifications for dependencies. Nothing else
in these repos currently watches for vulnerable dependencies, so that
coverage is gone until something replaces it.

Code review agent added

Two layers, deliberately split so routine PRs stay cheap:

	Runs	Scope
Copilot	Automatically on every PR to the default branch	Fast first pass. Enforced by the Code Quality Copilot review for default branch ruleset, now active.
Claude	On demand	Deeper pass. Triggered by @claude in a comment, or by adding the deep-review label to a PR.

.github/workflows/claude-code-review.yml uses anthropics/claude-code-action@v1.
Its review prompt points Claude at this repo's own CLAUDE.md, QUALITY.md,
TESTING.md, SECURITY.md and VERIFY.md rather than generic style rules, and
prioritises correctness → security → tests → maintainability.

Warning

Two prerequisites are not satisfied yet, and both need an org admin:

1. ANTHROPIC_API_KEY org secret does not exist. Until it is added, both
   Claude jobs fail fast with a clear error rather than running without
   credentials.
2. Copilot seats: 0 assigned. The org has Copilot Business available but
   seat_breakdown.total is 0, so the ruleset is active but nothing reviews
   until seats are assigned. That is a billing action, deliberately left alone.

Verification

Builds and test suites were run on this branch; results are in the PR
conversation where the branch carries code changes.

[srpatcha]

Review — one blocking issue, one to decide

Reviewed as one change: this same PR is open across 14 public repos in the org, all with the same shape.

Blocking: the @claude trigger is unauthenticated on a public repo

The mention job fires on any issue_comment whose body contains @claude, with no check on who wrote it:

(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude'))

This repo is public. Any GitHub user — no fork, no PR, no write access — can comment @claude on any issue and start a 20-minute job that spends the org's ANTHROPIC_API_KEY. There is no rate limit in front of it, and cancel-in-progress only dedupes within a single issue, so N issues means N concurrent jobs.

Gate it on the commenter's relationship to the repo:

github.event.comment.author_association == 'OWNER' ||
github.event.comment.author_association == 'MEMBER' ||
github.event.comment.author_association == 'COLLABORATOR'

The same gate is needed on the pull_request_review_comment, pull_request_review, and issues arms — issues: [opened] means a first-time issue reporter triggers it too. The deep-review job is fine as it stands: applying a label already requires write access.

Correct as written, worth recording

pull_request rather than pull_request_target, and contents: read. That combination is what keeps a fork's code from running with the base repo's secrets, and it is the thing most often gotten wrong in this kind of workflow. The issue_comment arm checks out the base branch, not the PR head, so untrusted code is not executed there either.

To decide: Dependabot is being removed, not replaced

The PR deletes .github/dependabot.yml and adds a review bot. Those cover different things — Copilot and Claude review your diff; Dependabot tells you a dependency you already shipped has a published CVE. After this merges, nothing in the repo is watching for that.

Not an objection to the PR — the Dependabot config was noisy, and consolidating review makes sense. But if the intent is "we no longer need automated dependency alerts", that is worth stating; if it is not the intent, Dependabot security-updates only (no version bumps) or GitHub's built-in Dependabot alerts would keep the CVE path without the weekly PR noise.

Verification

Static review of the workflow only — not run. author_association gap confirmed by grep across all 14 PRs (0 occurrences in each); public visibility confirmed via the API for each repo.

[srpatcha]

Review — eIPC#30 "chore(ci): remove Dependabot, add Claude + Copilot code review"

head: b71d65a author: srpatcha ci: pass (5 checks: CodeQL Go ×2, CodeQL python, CodeQL, assign — no build or test job ran, see finding 1)

Verdict: Already reviewed. The claude-code-review.yml this adds is byte-identical to the copy on the eCAD#20, eFirmware#1, eNI#29 and #7 threads — I extracted the added lines from all five diff.patch files and hashed them: 132 lines, sha256 05c2a32b33772cff… in every case — and the same review comment is on each thread. That review stands and I am not repeating it; the unauthenticated @claude trigger remains the blocking item, and it should be settled once and applied to all five rather than negotiated five times. Unlike eFirmware#1, this repo's body is accurate: .github/dependabot.yml does exist on origin/master and is genuinely deleted here. Two things the existing comment does not cover, both about what green means on this PR.

Findings

#	Severity	File:line	Finding	Recommended fix
1	Medium	checks.txt; .github/workflows/ci.yml:5-8 on origin/master (not in this diff)	All five green checks are CodeQL and auto-assign; no build, no test and no static analysis ran, because ci.yml on this base is still filtered to a branch that does not exist. On origin/master the trigger is push: branches: [main, develop] / pull_request: branches: [main]. The default branch is master in every clone and no clone has an origin/main (git show-ref --verify refs/remotes/origin/main fails in all 20). eIPC#31 is the fix and is not merged. So the green wall on this PR is not evidence that the repository builds — it is evidence that nothing tried. This is a diff that touches only .github/, so nothing is actually at risk here; it matters because the identical green wall appears on the other four chore(ci) PRs and reads as "CI is fine". It is not: on #31, where the trigger is fixed, Build & Test (Linux x86_64) fails outright.	Nothing to change in this PR. Merge #31 first if you want a real signal on this one; otherwise state on the thread that the checks here cover CodeQL only.
2	Low	PR body, "Verification"	The stated verification does not exist on this thread. The body closes "Builds and test suites were run on this branch; results are in the PR conversation where the branch carries code changes." This branch carries a code change — a workflow file and a config deletion — and existing-comments.txt holds one comment, a static review of the workflow whose own closing line is "Static review of the workflow only — not run." Per the brief, an unsupported "verified" is itself the finding. The sentence is defensible on eFirmware#1, where the diff is a single workflow file and the claim is conditional on code changes; here the conditional is met and nothing backs it.	Replace with what is true: the workflow cannot run until ANTHROPIC_API_KEY exists, and the Dependabot deletion needs no test. Or drop the section — a .github/-only change does not owe a test run, and claiming one it does not have is worse than claiming nothing.

Verified clean, recorded because a bulk deletion across 14 repositories is exactly where a wrong file gets removed:

• The Dependabot deletion is real and complete here, and nothing else references the file. git cat-file -e origin/master:.github/dependabot.yml succeeds, so unlike eFirmware#1 the body's "deleted here" is accurate. files.txt is 0+ 75- .github/dependabot.yml — a whole-file delete of the 75-line org template, of which only the github-actions stanza was uncommented. .github/ retains PULL_REQUEST_TEMPLATE.md and workflows/; nothing in the 14 workflow files reads the Dependabot config.
• The prompt's premise holds in this repository. claude-code-review.yml:191-195 directs the reviewer to "this repository's own CLAUDE.md, QUALITY.md, TESTING.md, SECURITY.md and VERIFY.md". All five exist at the root of this clone, alongside AGENTS.md, MODES.md, ORCHESTRATION.md, HANDOFF.md and SECURITY-STANDARDS.md. A prompt pointing at absent files would silently degrade to generic review; here it does not.
• No source, build or release path is touched. files.txt is two files, both under .github/, neither a workflow that any other workflow calls. go.mod, Makefile, sdk/c/CMakeLists.txt and the 13 pre-existing workflows are untouched, so the CodeQL results on this head are the same ones that were green on the base.

Architecture conformance

Conforms. §21 places eIPC in Tier 2 — Core Platform ("Communication, security, connectivity and lifecycle"); everything in this diff falls under §21's Infrastructure row ("Governance, release automation and documentation"). §5.1's dependency law is not engaged: no #include, import, link line, target_link_libraries entry or manifest dependency is added or removed, and both files are host-side CI configuration, never a runtime dependency — which is also the §5.1 clause about eBuild ("understands the complete graph but is not a runtime dependency") applied to CI. §21.1 is not engaged; no code moves and no repository is created.

§12's split between EoS IPC Core (§12.1) and eIPC Fabric (§12.2) is the section that governs this repository's substance, and this diff does not touch it. I raised on #31 that neither side of that split currently has a working CI gate; that belongs on #31, where the workflow is the subject, not here.

No proposal appended. Nothing in the master design is wrong, stale or silent on anything this PR raises — §21's Infrastructure row already covers repository CI configuration, and the green-but-empty-check problem behind finding 1 is already the subject of the §28 proposal in proposals/2026-09.md ("The evidence policy is silent on checks that verify nothing").

Proposed changes

1. Settle the author_association gate from the existing review, and apply the agreed patch to all five identical copies in one pass.
2. Fix or drop the Verification section (finding 2).
3. Merge eIPC#31 before or with this, so the checks on .github/-only PRs in this repository mean something (finding 1).

All three are independent. Item 1 is the only one blocking.

Not checked

• I did not re-review claude-code-review.yml. I established the added lines are byte-identical to the four already-reviewed copies rather than re-reading the file for new problems, and confirmed the reported gap is still open on this head (grep -c author_association over the added lines → 0). I read lines 191-195 only, for the file-existence check above. Anything the existing comment missed in that workflow, I have also missed.
• No build, no tests, no static analysis. Nothing in this repository was compiled or run for this review. The go.mod, Makefile and sdk/c observations are from reading the tree. CI state is taken from checks.txt; I did not fetch any job log.
• Dependabot's actual effect here is unverified. I confirmed the file existed and is deleted, and that only its github-actions stanza was active. Whether that stanza had ever opened a PR in this repository, and whether GitHub's repository-level Dependabot alerts (independent of this file) are still on, I did not query — and the body's claim that alerts were disabled org-wide via the API on 26 repositories is org-admin state this run has no mandate to check.
• The org-wide claims are unverified: 90 closed Dependabot PRs, the missing ANTHROPIC_API_KEY org secret, 0 Copilot seats, and the Code Quality Copilot review for default branch ruleset being active.
• mergeStateStatus: BLOCKED, mergeable: MERGEABLE, reviewDecision: REVIEW_REQUIRED. No merge attempted, nothing pushed. This PR and #31 both touch .github/workflows/ but different files, so I do not expect a conflict; I did not perform a trial merge.
• The clone sits on fix/ci-runs-on-master (#31's branch), not this PR's head. The sync step reported it clean; I read this PR from diff.patch and read origin/master through git cat-file/git show. The working tree is unchanged.

---

Automated architecture review of b71d65ab925a — scheduled, model claude-opus-5, checked against the EmbeddedOS Master Design v2.0. Advisory only: this reviewer never approves, requests changes, or merges. Reply here to discuss or push back — a wrong finding is a bug worth reporting.