What this is
The digest workflow itself shipped and works (#130, merged 2026-09-12). What's blocked is moving it off three fine-grained PATs onto a single GitHub App install, because a fine-grained PAT has no Checks permission at all (community#129512) — it silently nulls every CheckRun on a private repo rather than erroring, which can turn failing builds into "nothing failing."
Plan: docs/plans/2026-09-11-dependabot-digest-github-app.md. The migration is workflow-only; no digest script changes.
Blocker
Installing a GitHub App on all three owners is a human-only step (only an account owner can do it — see the org-migration finding in docs/STATUS.md: "GitHub App installations do not follow repo transfers" and cannot be done by an Action).
Related, separate decision
dev-env#120 (soak-then-accept: auto-merge majors after a week of green CI) stays open until a real run exists to link from its closing comment — not blocked on this migration, but adjacent.
What this is
The digest workflow itself shipped and works (#130, merged 2026-09-12). What's blocked is moving it off three fine-grained PATs onto a single GitHub App install, because a fine-grained PAT has no
Checkspermission at all (community#129512) — it silently nulls every CheckRun on a private repo rather than erroring, which can turn failing builds into "nothing failing."Plan:
docs/plans/2026-09-11-dependabot-digest-github-app.md. The migration is workflow-only; no digest script changes.Blocker
Installing a GitHub App on all three owners is a human-only step (only an account owner can do it — see the org-migration finding in
docs/STATUS.md: "GitHub App installations do not follow repo transfers" and cannot be done by an Action).Related, separate decision
dev-env#120(soak-then-accept: auto-merge majors after a week of green CI) stays open until a real run exists to link from its closing comment — not blocked on this migration, but adjacent.