[joris-sevenlab]

What this changes

A Dependabot PR that changes a template a scaffold emits now gets the feature version bump and a changelog line it needs, pushed onto the PR by a workflow, so its CI goes green without a manual commit.

Why

The Docker base-image PRs (#104 today) change packages/preset-nuxt4/templates/docker/Dockerfile. That fails the feature version gate and the changelog gate until someone bumps shared:docker and writes an entry by hand. Without the bump, existing projects never get the new image on battlestack pull.

How

• pnpm bump:check --fix patch-bumps every feature the gate would fail on, including the writer features the docs/env rule names.
• .github/workflows/dependabot-bump.yml, on pull_request_target, only for PRs Dependabot opened:
  • runs --check --fix against the PR's base,
  • when that bumped something and the PR has no changelog entry yet, adds one under ## Unreleased from the PR title (fix(docker): bump node from a to b in /x becomes Bump node from a to b in /x.),
  • commits and pushes to the PR branch with RELEASE_PR_TOKEN. A GITHUB_TOKEN push starts no workflows, so the required checks would never rerun.
• Nothing from the PR is installed or built: the bump script needs only Node's own modules, run through a pinned tsx. The second run, triggered by its own push, finds nothing to bump and exits.

Type of change

• Bug fix
• New feature or template
• Refactor with no behaviour change
• Documentation
• Build, CI or release tooling

AI assistance

• No AI agent involved
• Claude Code
• Cursor
• GitHub Copilot
• Codex
• Other, named below

Agent, service and model, if you know it: Claude Code, Opus 5.5

How much of this is agent-written?

• Whole change, reviewed by me before opening
• Substantial parts, with my own edits on top
• Small parts, or just the tests or docs
• Only the commit message or this description

Testing

# a Dependabot-style Dockerfile change on this branch
echo "# probe" >> packages/preset-nuxt4/templates/docker/Dockerfile
BUMP_CHECK_BASE=origin/main pnpm bump:check --fix   # shared:docker 1.2.3 -> 1.2.4
BUMP_CHECK_BASE=origin/main pnpm bump:check         # OK

The title-to-changelog conversion was checked with GNU sed, as on the Ubuntu runner.

• pnpm tsc passes
• pnpm test passes (no test covers the bump script)
• I removed the behaviour each new assertion covers, watched the test fail, and put it back

Anything else

• GitHub runs pull_request_target workflows only from the default branch, so this proves itself on the first Docker digest PR after merging.
• Pushing to a Dependabot branch makes Dependabot stop rebasing that PR, the same as a manual commit does.
• pull_request_target checks out the PR head with a write token. That is safe here because it only runs for PRs Dependabot opened and never installs or runs their dependencies.