ci(security): run the weekly Dependabot fix routine in GitHub Actions (Bundler)

[PMerlet]

Why

The weekly "Fix vulnerabilities" claude.ai cloud routines have been failing with 403 on the Dependabot alerts API. Root cause (established 2026-07-23): the Claude cloud environments' GitHub proxy replaces the Authorization header of every request to api.github.com with its own GitHub App user-to-server token — regardless of any PAT configured in the environment — and that token cannot read Dependabot alerts, Actions runs, or commit statuses. This is by design ("keeps your real GitHub credentials outside the sandbox"), so the routine can never work there.

This PR moves the same routine into GitHub Actions (instructions adapted from npm/yarn to Bundler for this repo), where secrets reach the job untouched.

What

• .github/workflows/security-fixes.yml — scheduled job (Thursdays 11:00 UTC, same slot as before), runs the agent via anthropics/claude-code-action@v1, 120 min timeout, manual trigger available (workflow_dispatch).
• .github/security-fixes-prompt.md — the agent instructions (same battle-tested prompt as the cloud routine: preflight probe, strict triage with explicit ignore reasons, 7-day age gate, narrowest-bump-first strategy, pin/resolution hygiene audit, PR with the :lock: security label pinging @first_level_support, CI monitoring with a 3-retry cap).

Before merging — org secrets required

The workflow needs two organization-level secrets (shared by the 5 repos getting this workflow: forestadmin-server, forestadmin, toolbelt, agent-nodejs, agent-ruby):

Secret	Value
SECURITY_GH_PAT	The "Claude routines" fine-grained PAT (Dependabot alerts RO, Contents RW, Workflows RW, Pull requests RW, Issues RW, Actions RW, Commit statuses RO on the 5 repos)
ANTHROPIC_API_KEY	A Claude API key

Without them, the run stops at preflight with an explicit error message.

Notes

• The claude.ai cloud routines are disabled (kept for reference, not deleted).
• First run: next Thursday 13:00 Paris — or trigger it manually from the Actions tab to validate earlier.

🤖 Generated with Claude Code

Note

Add weekly automated Dependabot security-fix workflow using Claude

• Adds security-fixes.yml, a GitHub Actions workflow that runs weekly (and on manual dispatch) to automate Dependabot alert triage and dependency bumps for the Ruby/Bundler monorepo.
• The workflow checks out the repo, installs Ruby 3.4 deps, then invokes anthropics/claude-code-action with ANTHROPIC_API_KEY and SECURITY_GH_PAT to execute the runbook in security-fixes-prompt.md.
• The runbook defines alert triage logic, dependency bump strategy, PR creation/labeling flow, and CI retry procedures with exact shell commands and API calls.
• Concurrency is limited to one run at a time via the security-fixes group, with a 240-minute job timeout.

^{Macroscope summarized 128b73c.}