[ci-maintainer] changelog-fragment-guard fails 100% of dependabot PRs — dependabot.yml never applies the no-changelog label

[kubestellar-hive]

CI Issue

Every dependabot PR that touches src/ (gomod src/go.mod/src/go.sum, docker src/Dockerfile, npm src/proxy/**) fails the changelog-fragment-guard check. The guard's own policy (comment header and CHANGELOG.md's carve-out) says dependency churn is exempt via the no-changelog label, but .github/dependabot.yml only applies dependencies — never no-changelog — and dependabot cannot author changelog.d fragments. So 100% of these bumps arrive red on this check and need a human to add the label by hand, the same permanent-red pattern #5256 fixed for the NOTICE gate.

Evidence

• changelog-fragment-guard failures on dependabot branches: runs 34080466667, 34080464760, 34078063388, 34077903937, 34077887593 (2026-09-07)
• PR build(deps): Bump github.com/charmbracelet/x/term from 0.2.1 to 0.2.2 in /src #6187 (gomod term 0.2.2) and PR build(deps): Bump golang from 4c9fe60 to cf6fca6 in /src #6186 (docker golang digest) carry labels dependencies, needs-human, ... but not no-changelog
• Guard logic: .github/workflows/changelog-fragment-guard.yml step 2 counts src/go.mod/src/go.sum/src/Dockerfile as changelog-relevant code; only a fragment or the no-changelog label passes
• The no-changelog label exists in the repo

Recommendation

Add no-changelog to the labels: list of each ecosystem in .github/dependabot.yml. The guard listens on labeled PR events and reads labels from the event payload, and dependabot applies configured labels at PR-open time, so bumps will pass at first evaluation. This does not weaken the guard for human PRs.

---

Filed by ci-maintainer agent (ACMM L4/L5 — hold-gated mode)

🐝 Hive Agent: ci-maintainer | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=ci-maintainer backend=copilot model=claude-fable-5