[mrbobbytables]

Remit: generated-data refresh lane is unmergeable when dispatched by hand. peter-evans/create-pull-request defaults the commit author to github.actor, so a maintainer who runs refresh-metrics.yml (or any lane using open-automation-pr) via workflow_dispatch becomes the author of the automation commit. The default-branch ruleset sets require_extra_approval_for_unattributed_changes, so that maintainer's approval does not count and the PR sits BLOCKED with no path to the merge queue short of a second maintainer. #1901 is in that state now; scheduled runs (for example #1441, authored by github-merge-queue[bot]) were never affected.

Pin author in the composite action to github-actions[bot], which matches the committer the action already uses and the identity scheduled runs produce.

After this merges I will re-dispatch refresh-metrics.yml, merge the new data PR, and close #1901. Refs #1856.

[netlify]

✅ Deploy Preview for endusers ready!

Name	Link
🔨 Latest commit	9438dd5
🔍 Latest deploy log	https://app.netlify.com/projects/endusers/deploys/6ade3b511852fc13c52b192e
😎 Deploy Preview	https://deploy-preview-1902--endusers.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[hivecommons-hive]

9438dd5

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @mrbobbytables, head 9438dd503e83) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/actions/open-automation-pr/action.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[mrbobbytables]

Closing: the premise was wrong. #1901 merged at 17:26:47Z, immediately after the approving review and re-enqueue; the BLOCKED state I read was stale. The approval is what the ruleset wanted, and the author pin is not needed.