Explain why Dependabot PR with auto-merge enabled is blocked from merging

[Copilot]

PR #164 has auto-merge enabled and all CI checks passing, but mergeable_state is blocked — the only approval is from github-actions[bot] (the auto-merge workflow itself), which GitHub does not count toward branch protection's required human reviewer threshold.

Description

Investigated the auto-merge pipeline for the Dependabot PR bumping actions/setup-go (v6.2.0→v6.3.0) and actions/upload-artifact (v6.0.0→v7.0.0).

Root cause: dependabot-auto-merge.yaml correctly approves and enables squash auto-merge, but the approval comes from github-actions[bot]. GitHub branch protection on main requires at least one human approval; bot approvals do not satisfy this requirement.

Status of all checks on PR #164:

• CI workflow: ✅ success
• FOSSA License Compliance: ✅ success
• FOSSA Security Analysis: ✅ success
• FOSSA Dependency Quality: ✅ success
• Human reviewer approval: ❌ missing → mergeable_state: blocked

A human with write access must approve the PR to unblock auto-merge.

What does this PR do?

Responds to the question in the PR comment explaining why auto-merge is stalled, with no code changes needed.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• New chore (expected functionality to be implemented)

Checklist:

• My change requires a change to the documentation.
  • I have updated the documentation accordingly.
• I've signed off with an email address that matches the commit author.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.