Add workflow that fails when Dependabot updates error#61
Open
claude[bot] wants to merge 2 commits into
Open
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by William Storey, Greg Oschwald · Slack thread
Before: when a Dependabot version-update job errors (e.g. gradle can't resolve a dependency), nothing surfaces it — the failure only shows as a red triangle in Insights → Dependency graph → Dependabot, which nobody checks. That's how this repo's gradle updates were silently broken for ~7 months while github-actions updates kept flowing.
After: a lightweight workflow goes red in the Actions tab whenever a
Dependabot Updatesrun completes with a failure, so a broken ecosystem shows up through normal Actions-failure surfacing instead of being invisible.How: Dependabot version updates now run as regular Actions workflow runs named
Dependabot Updates. This adds.github/workflows/dependabot-failure-watcher.yml, triggered onworkflow_runcompletion of that workflow, which exits non-zero when the run'sconclusionisfailure. No secrets, no token permissions (permissions: {}).Verified: this repo's
Dependabot Updatesworkflow currently shows 184 failed runs (all gradle) from Dec 2025–Jul 2026 while all github-actions runs succeeded, so the watcher will fire on the real, ongoing gradle failures immediately.Known caveat: a
failureconclusion also covers the benign "Dependabot cannot open any more pull requests" case (the open-PR limit being reached), so this may occasionally fire without a genuine error. If that proves noisy we can refine it to filter that case.Rollout: this is the reference PR; the same single file is intended to go into the other ~39 maxmind repos that have a Dependabot config.
Generated by Claude Code