ci(NOJIRA-1234): Withhold approval from risky bot PRs

Assess risk first, then approve only when the diff looks routine. A risky PR
now gets no approval at all, so it cannot satisfy the required-review count and
a human has to sign it off - the label alone was advisory, since a bot approval
already met the review requirement.

Also close the stale-arming gap: a PR can open looking routine (approved,
auto-merge armed) and then be force-pushed into something risky. On the risky
path the workflow now calls 'gh pr merge --disable-auto' and dismisses its own
earlier approval before labelling and commenting.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: Jlougedo-TF

.github/workflows/dependabot-automerge.yml

@@ -15,15 +15,10 @@ jobs:
     if: contains(fromJSON('["dependabot[bot]", "aikido-autofix[bot]"]'), github.actor)
 
     steps:
-      - name: Approve bot PR
-        run: gh pr review --approve "$PR_URL"
-        env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
       # A green CI run does not prove a transitive bump is safe: the repo's own
       # tests never exercise how the intermediate package uses the changed API.
-      # Anything matching below is left for a human instead of auto-merging.
+      # Anything matching below is neither approved nor auto-merged, so it cannot
+      # satisfy the required-review count and a human has to sign it off.
       - name: Assess dependency risk
         id: risk
         run: |
@@ -77,20 +72,40 @@ jobs:
           PR_TITLE: ${{ github.event.pull_request.title }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Approve bot PR
+        if: steps.risk.outputs.risky == 'false'
+        run: gh pr review --approve "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Enable auto-merge for bot PR
         if: steps.risk.outputs.risky == 'false'
         run: gh pr merge --auto --squash "$PR_URL"
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Flag risky bot PR for human review
+      - name: Hold risky bot PR for human review
         if: steps.risk.outputs.risky == 'true'
         run: |
+          # An earlier run may have approved and armed this PR while it still
+          # looked routine, so undo both before flagging it.
+          gh pr merge --disable-auto "$PR_URL" || true
+
+          gh api "repos/$REPO/pulls/$PR_NUMBER/reviews" \
+            --jq '.[] | select(.state == "APPROVED" and .user.login == "github-actions[bot]") | .id' \
+          | while read -r id; do
+              gh api -X PUT "repos/$REPO/pulls/$PR_NUMBER/reviews/$id/dismissals" \
+                -f message="Withdrawn: $REASON" >/dev/null || true
+            done
+
           gh pr edit "$PR_URL" --add-label needs-human
           gh pr comment "$PR_URL" --body \
-            "Not auto-merged: **$REASON**. A green CI run does not prove a transitive dependency bump is safe, so this one needs a human look."
+            "Held for human review: **$REASON**. A green CI run does not prove a transitive dependency bump is safe, so this PR was deliberately **not** approved and auto-merge is off. It needs a human to review and merge it."
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
           REASON: ${{ steps.risk.outputs.reason }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}