Dependabot can't open npm update PRs for .github/site-checks (400 invalid or unauthorized changes) #43

Problem

Since #40, Dependabot fails on the npm entry for .github/site-checks. The first run tried to update html-validate 11.16.2 → 11.17.0:

• npm install html-validate@11.17.0 --package-lock-only works.
• Submitting html-validate pull request for creation is logged.
• POST /update_jobs/…/create_pull_request comes back as 400 "The request contains invalid or unauthorized changes".
• The error is logged as dependency_file_not_supported.

Other Dependabot entries in this repository (gomod, github-actions, pip in .github/requirements) run without errors. In glsec, pip updates under .github/requirements and gomod updates under .github/tools/benchstat reach pull requests (for example glsec#686 and glsec#687), so a directory under .github/ alone doesn't explain it.

Already ruled out: the branch name with .github as a path component. pull-request-branch-name.separator: "-" (#41) changed nothing, and was reverted.

Next steps

1. Check what differs from the working pip/gomod setup. The overrides entry for basic-ftp in package.json is a candidate: it changes the lockfile outside the package being updated.
2. If the cause can't be found, move the npm tooling to a top-level directory. It is in .github/ only so that go test ./... doesn't walk node_modules. A go.mod file in that directory would do the same.
3. Until this is fixed, the tool versions in package.json have to be bumped by hand. npm audit in the "Site checks" job doesn't run on a schedule.