Link central governance badges in README

.github/workflows/auto-merge-dependabot-pull-requests.yml

@@ -4,7 +4,7 @@
 
 # Prerequisites:
 # - Configure Dependabot for the github-actions ecosystem in .github/dependabot.yml.
-# - Enable "Allow auto-merge" and "Allow squash merging" in repository settings.
+# - Enable "Allow auto-merge" and "Allow merge commits" in repository settings.
 # - Grant access to the OSPO GitHub App for this repository with Contents and Pull requests
 #   permissions set to Read and write, and approve any installation permission updates.
 # - Provide OSPO_WORKFLOW_APP_ID and OSPO_WORKFLOW_PRIVATE_KEY as Dependabot secrets
@@ -35,7 +35,7 @@ jobs:
     steps:
       - name: Fetch Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
         with:
           github-token: ${{ github.token }}
 
@@ -85,9 +85,9 @@ jobs:
         run: gh pr review "$PR_NUMBER" --approve
 
       # GitHub waits for required checks and any remaining review requirements.
-      # No ruleset bypass is needed for a standard one-approval requirement.
+      # GitFlow main rules require merge commits rather than squash merges.
       - name: Enable auto-merge for the pull request
         if: steps.metadata.outputs.package-ecosystem == 'github_actions' && steps.repository.outputs.enabled == 'true'
         env:
           GH_TOKEN: ${{ steps.target_token.outputs.token }}
-        run: gh pr merge "$PR_NUMBER" --auto --squash --match-head-commit "$HEAD_SHA"
+        run: gh pr merge "$PR_NUMBER" --auto --merge --match-head-commit "$HEAD_SHA"

.github/workflows/oss-checker.yml

@@ -91,7 +91,8 @@ jobs:
             const metadata = {
               repository: {
                 defaultBranch: process.env.DEFAULT_BRANCH,
-                hasDevelopBranch: hasDevelopBranch
+                hasDevelopBranch: hasDevelopBranch,
+                repositoryName: repo,
               }
             };
 
@@ -133,7 +134,15 @@ jobs:
             -p ospo-resources/tools/policy-as-code/policy \
             --data repository-metadata.json \
             --namespace github.dependabot \
-            --output json > policy-report.json || true
+            --output json > dependabot-policy-report.json || true
+          # Enforce GitFlow branch requirements independently of Dependabot configuration.
+          conftest test repository-metadata.json \
+            -p ospo-resources/tools/policy-as-code/policy \
+            --data repository-metadata.json \
+            --namespace github.repository \
+            --output json > repository-policy-report.json || true
+          # Preserve failures from both policy namespaces in the existing summary.
+          jq -s 'add' dependabot-policy-report.json repository-policy-report.json > policy-report.json
 
       - name: Process Policy Results
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

.github/workflows/stale-pr-alerts.yml

@@ -5,7 +5,7 @@ name: Stale Dependabot PR alerts
 
 on:
   schedule:
-        - cron: '35 14 * * *' # Temporary pilot schedule; restore 08:23 UTC after testing.
+    - cron: '23 8 * * *'
   workflow_dispatch:
     inputs:
       days_before_stale:
@@ -22,7 +22,7 @@ concurrency:
 
 jobs:
   stale-pr-alerts:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     timeout-minutes: 15
     steps:
       - name: Check open Dependabot pull requests
@@ -132,4 +132,4 @@ jobs:
               output.write(summary)
           print(summary)
           sys.exit(1 if failed else 0)
-          PY
+          PY

README.md

@@ -1,3 +1,5 @@
+![OSPO compliance](https://raw.githubusercontent.com/National-Node-Net/ndt-overwatch/sync/governance-badges/repositories/node-lib/ospo-compliance.svg) ![Develop activity](https://raw.githubusercontent.com/National-Node-Net/ndt-overwatch/sync/governance-badges/repositories/node-lib/develop-activity.svg) ![Last checked](https://raw.githubusercontent.com/National-Node-Net/ndt-overwatch/sync/governance-badges/repositories/node-lib/last-checked.svg)
+
 # README
 
 **Repository:** `node-lib`