feat: write back to Dependabot when security findings are auto-dismissed

[jeanduplessis]

Summary

• When the security agent auto-dismisses a finding (via triage or sandbox analysis), also dismiss the corresponding Dependabot alert on GitHub via the API
• Previously only manual dismissals wrote back to Dependabot; this extends writeback to maybeAutoDismissAnalysis and the bulk autoDismissEligibleFindings flow
• Writeback is wrapped in error handling so GitHub API failures don't break the local auto-dismiss flow — errors are logged to Sentry but the dismissal still succeeds

Changes

• auto-dismiss-service.ts: Added writebackDependabotDismissal (fetches finding + integration, calls dismissDependabotAlert) and safeWritebackDependabotDismissal (error-safe wrapper). Integrated into sandbox auto-dismiss, triage auto-dismiss, and bulk auto-dismiss paths.
• auto-dismiss-service.test.ts: New test file covering writeback for sandbox/triage auto-dismiss, skip conditions (non-dependabot source, missing integration, invalid source_id, bad repo name), and resilience when GitHub API fails.

[kiloconnect]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

The PR adds Dependabot writeback functionality to the auto-dismiss service. When findings are auto-dismissed (via triage, sandbox, or bulk), the corresponding Dependabot alert on GitHub is also dismissed via the API.

Key observations:

• writebackDependabotDismissal properly validates all preconditions (source type, alert number parsing, repo name format, installation ID) with early returns for each invalid state.
• safeWritebackDependabotDismissal wraps the writeback in try/catch with Sentry error reporting, ensuring writeback failures are non-fatal.
• The writeback is integrated into all three dismiss paths (sandbox, triage, bulk) consistently, always called after dismissFinding so a writeback failure cannot prevent local dismissal.
• The previous review comment about misleading JSDoc has been addressed — the doc now correctly states the function may throw.
• Tests cover the happy path, all skip conditions, both sandbox and triage auto-dismiss flows with writeback verification, disabled auto-dismiss, and error resilience when the Dependabot API fails.

Files Reviewed (2 files)

• src/lib/security-agent/services/auto-dismiss-service.ts
• src/lib/security-agent/services/auto-dismiss-service.test.ts