Add Dependabot auto-merge workflows (ROSA-745)#304
Conversation
WalkthroughAdds a Dependabot auto-merge workflow that enables squash auto-merge for safe updates and posts notices for major updates, plus a scheduled/manual validation workflow that verifies the Dependabot config and the auto-merge workflow structure. ChangesDependabot Automation Workflows
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes 🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsGit: Failed to clone repository. Please run the Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: MitaliBhalla The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/dependabot-auto-merge.yml (1)
105-106: 💤 Low valueInconsistent error handling for comment failures.
The auto-merge step suppresses comment failures with
|| true(line 105), while the major version step fails the job if commenting fails (lines 131-135). This inconsistency could mask issues where auto-merge failed and the fallback notification also failed silently.Consider making the behavior consistent—either both should warn without failing, or both should fail the job.
Also applies to: 131-135
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/dependabot-auto-merge.yml around lines 105 - 106, The two comment steps are inconsistent: the auto-merge step currently appends "|| true" to ignore failures while the major-version step lets comment failures fail the job; decide on a consistent behavior and apply it to both places—either remove the "|| true" from the auto-merge comment command so failures bubble up (so both fail the job), or add "|| true" to the comment command(s) in the major-version step (lines referencing the major version comment command) so both only warn; update the shell commands that post comments (the ones with "|| true" and the major-version comment command) accordingly and ensure the same error-handling pattern is used in both steps.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/dependabot-auto-merge.yml:
- Around line 3-5: The workflow currently triggers on pull_request_target with
types: [opened, synchronize, reopened, ready_for_review], causing duplicate bot
comments on each push; either remove "synchronize" from that types array to stop
re-running on PR pushes, or, if you need synchronize, add a pre-post check in
the job that posts comments to first query existing PR comments for the bot's
marker (author or a unique comment signature) and skip posting when a matching
comment already exists; look for the trigger block "on: pull_request_target" and
the types array and the step that creates comments (the comment-posting action)
to implement the chosen fix.
- Around line 27-30: Update the GitHub Actions conditional in the
dependabot-auto-merge workflow by removing the invalid check
'version-update:semver-digest' from the if expression (the multiline condition
using steps.metadata.outputs.update-type). Keep only the valid tokens emitted by
dependabot/fetch-metadata (e.g., 'version-update:semver-patch' and
'version-update:semver-minor' and add 'version-update:semver-major' if desired)
or otherwise adjust the condition to match your intended auto-merge policy; if
you need digest handling, manage it via dependabot.yml ignore rules instead of
adding 'version-update:semver-digest' here.
---
Nitpick comments:
In @.github/workflows/dependabot-auto-merge.yml:
- Around line 105-106: The two comment steps are inconsistent: the auto-merge
step currently appends "|| true" to ignore failures while the major-version step
lets comment failures fail the job; decide on a consistent behavior and apply it
to both places—either remove the "|| true" from the auto-merge comment command
so failures bubble up (so both fail the job), or add "|| true" to the comment
command(s) in the major-version step (lines referencing the major version
comment command) so both only warn; update the shell commands that post comments
(the ones with "|| true" and the major-version comment command) accordingly and
ensure the same error-handling pattern is used in both steps.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: dbf4fc54-46e5-4c74-94de-a5b7a64cb8ad
📒 Files selected for processing (2)
.github/workflows/branch-protection-check.yml.github/workflows/dependabot-auto-merge.yml
MitaliBhalla
force-pushed
the
chore/dependabot-auto-merge
branch
5 times, most recently
from
97d0a60 to
954d5dd
Compare
- Auto-merge patch/minor/digest after CI; majors manual - pull_request_target with validated API responses - branch-protection-check for config/workflow presence Co-authored-by: Cursor <cursoragent@cursor.com>
MitaliBhalla
force-pushed
the
chore/dependabot-auto-merge
branch
from
954d5dd to
90dea60
Compare
|
@MitaliBhalla: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/branch-protection-check.yml:
- Around line 62-68: The YAML loader is converting the unquoted top-level on:
key to a boolean so wf.get("on") returns None; replace yaml.safe_load(...) with
yaml.load(..., Loader=yaml.BaseLoader) when loading the workflow (the code
around workflow_path.open() and wf = yaml.safe_load(f)) so the top-level "on"
key is preserved as a string, then keep the existing checks that call
wf.get("on") and validate pull_request_target.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 533c18bc-81c4-4b36-8d70-734d92b15158
📒 Files selected for processing (2)
.github/workflows/branch-protection-check.yml.github/workflows/dependabot-auto-merge.yml
| with workflow_path.open() as f: | ||
| wf = yaml.safe_load(f) | ||
| if not isinstance(wf, dict): | ||
| fail("dependabot-auto-merge.yml must be a YAML mapping") | ||
| on = wf.get("on") | ||
| if not isinstance(on, dict) or "pull_request_target" not in on: | ||
| fail("dependabot-auto-merge.yml must use pull_request_target trigger") |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
import yaml
wf = yaml.safe_load(Path(".github/workflows/dependabot-auto-merge.yml").read_text())
print("top-level keys:", list(wf.keys()))
print('wf.get("on") =', wf.get("on"))
print('wf.get(True) =', wf.get(True))
PYRepository: openshift/gcp-project-operator
Length of output: 257
Use yaml.BaseLoader to preserve the on key as a string.
The code uses yaml.safe_load(), which treats the unquoted top-level on: key in YAML as the boolean value True rather than the string "on". This causes wf.get("on") to return None, so the validation will incorrectly reject the valid workflow file. The workflow's actual trigger configuration is stored at key True instead.
Proposed fix
with workflow_path.open() as f:
- wf = yaml.safe_load(f)
+ wf = yaml.load(f, Loader=yaml.BaseLoader)
if not isinstance(wf, dict):
fail("dependabot-auto-merge.yml must be a YAML mapping")
on = wf.get("on")🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/branch-protection-check.yml around lines 62 - 68, The YAML
loader is converting the unquoted top-level on: key to a boolean so wf.get("on")
returns None; replace yaml.safe_load(...) with yaml.load(...,
Loader=yaml.BaseLoader) when loading the workflow (the code around
workflow_path.open() and wf = yaml.safe_load(f)) so the top-level "on" key is
preserved as a string, then keep the existing checks that call wf.get("on") and
validate pull_request_target.
|
On hold — pausing this per-repo workflow rollout while we switch to the boilerplate / MintMaker (Renovate) path for ROSA-745. Please do not merge; we will close or reopen after the platform PR lands. |
1 participant
Summary
Dependabot auto-merge for routine updates (ROSA-745 / ROSAENG-751), aligned with openshift/backplane-cli (SREP-2438).
Changes
pull_request_target(no PR checkout), validated GraphQL/REST/comment responses.Notes
dependabot[bot]+openshiftorg only.Test plan
Made with Cursor
Summary by CodeRabbit