Problem

Anvil consumes ex_git_objectstore as a git dependency pinned by SHA in mix.lock. In dev it resolves via [path: "../ex_git_objectstore"] (mix.exs), but the Docker build and CI resolve the pinned SHA from the git remote.

Nothing bumps that pin. A fix can land on egos main and sit there indefinitely while Anvil keeps building against an older SHA — which is exactly the situation today: egos#78’s receive-pack fix and egos#75’s test isolation fix will both be invisible to Anvil until someone remembers to run mix deps.update ex_git_objectstore by hand.

Proposal

Gate a step on merges to egos main that opens a PR on fangorn/anvil updating the pin, so the bump goes through Anvil’s normal review and full test suite rather than landing unverified.

The PR is opened, never merged automatically. Anvil’s CI is the gate; a human merges.

Requirements

• Triggers only on a real merge to egos main — not on feature branches, not on tags.
• Updates mix.lock’s ex_git_objectstore entry to the new main SHA, and nothing else.
• Opens a PR on fangorn/anvil against main, titled and bodied so a reviewer can see which egos commits are being pulled in.
• Idempotent: if an open pin-bump PR already exists, update it in place rather than opening a second one. Repeated merges to egos main must not produce a pile of PRs.
• Never merges, never deploys.
• A failure to open the PR must fail the job loudly, not silently skip.

Known design constraint: credentials

The ANVIL_TOKEN the runner injects is a per-job token scoped to the dispatching repo and auto-revoked when the job ends. It cannot write to fangorn/anvil — repo scoping is enforced (job_api_token_repo_id, see fangorn/anvil#390).

So this step needs a cross-repo credential supplied as a CI secret with permission to push a branch and open a PR on fangorn/anvil. Provisioning that secret is an admin action and a prerequisite; the step must fail with a clear message when the secret is absent rather than half-working.

Gating gotcha

Use an exact branch comparison. branch contains 'main' is a substring match and matched feat/324-git-maintenance — see fangorn/anvil#234. The existing release step compares HEAD against origin/main because CI checks out a detached HEAD; follow that precedent.