Dependabot has no auto-merge policy and doesn't keep both `Cargo.lock` files in sync

[Ejirowebfi]

🔴 Critical · .github/dependabot.yml, contracts/Cargo.lock, contracts/token-factory/fuzz/Cargo.lock (implied by the fuzz crate being a separate workspace member)

Description

contracts/token-factory/fuzz is its own Cargo project (has its own Cargo.toml, likely its own lockfile, per standard cargo-fuzz project layout) alongside the main contracts/Cargo.lock. Dependabot configuration (existence confirmed, contents not reviewed in depth) needs to cover both lockfiles independently, or a dependency bump in the main contract workspace can silently leave the fuzz workspace pinned to older, potentially-vulnerable transitive dependencies that cargo audit's main-workspace run (per issue #31) wouldn't necessarily catch if security-audit.yml's cargo audit step doesn't separately target the fuzz workspace.

Tasks

• Review .github/dependabot.yml and confirm it has a package-ecosystem entry covering contracts/token-factory/fuzz specifically, not just contracts/.
• Confirm (or add) a cargo audit step in security-audit.yml that runs against the fuzz workspace's lockfile too, not just the main contract workspace.
• Establish an explicit policy for auto-merging Dependabot PRs (e.g. auto-merge patch-level bumps that pass CI unattended; require manual review for minor/major) and configure it via GitHub's auto-merge + branch protection, rather than leaving every Dependabot PR to accumulate unreviewed indefinitely (a common source of the exact "known vulnerability sits unpatched for months" problem security scanning is meant to prevent).
• Document the policy in CONTRIBUTING.md.

Acceptance Criteria

• Both contracts/Cargo.lock and the fuzz workspace's lockfile receive Dependabot coverage and are independently audited in CI.
• A documented, configured auto-merge policy exists for low-risk dependency updates.

[Faithy5]

Hello. I would love to work on this project as I have hands-on experience on it. After reviewing the scope of this issue, I’m confident in my ability to deliver a complete, well-tested solution.

I’d be grateful for the opportunity to contribute and help advance this project. Thank you.

[soloking1412]

I run CI/CD and dependency hygiene across most of my own Rust and Solidity projects, and I've dealt with exactly this fuzz-workspace blind spot before, a separate Cargo.toml under contracts/ that Dependabot silently skips while the parent workspace gets covered. For this I'd first confirm whether contracts/token-factory/fuzz has its own lockfile, then add a dedicated package-ecosystem entry for it in dependabot.yml with its own directory path, schedule, and label so it's tracked independently rather than assumed to inherit from the main workspace. Same for security-audit.yml, I'd add a second cargo audit step scoped to the fuzz lockfile so a vulnerability there doesn't hide behind a clean main-workspace scan. For auto-merge, I'd set patch-level bumps that pass CI to merge automatically via GitHub's auto-merge plus a required-status branch protection rule, and require manual review for minor/major bumps, since those are far more likely to break contract behavior silently. I'd document the policy directly in CONTRIBUTING.md so it's not tribal knowledge. Happy to take this on.

[Mystery-CLI]

I would like to work on this issue

[grantfox-oss]

🦊 GrantFox — @Mystery-CLI has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #941)
2. Your PR will be reviewed by the Favourorg maintainers

Good luck! Track your progress on GrantFox.