Add Dependabot auto-merge workflows (ROSA-745)#323
Conversation
WalkthroughAdds two GitHub Actions workflows: a scheduled branch-protection check validating Dependabot and workflow YAML, and a Dependabot auto-merge workflow that enables squash auto-merge for patch/minor updates and posts warnings for major updates. ChangesDependabot Automation and Validation
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes 🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: MitaliBhalla The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
MitaliBhalla
force-pushed
the
chore/dependabot-auto-merge
branch
5 times, most recently
from
dfe481a to
cf77178
Compare
- Auto-merge patch/minor/digest after CI; majors manual - pull_request_target with validated API responses - branch-protection-check for config/workflow presence Co-authored-by: Cursor <cursoragent@cursor.com>
MitaliBhalla
force-pushed
the
chore/dependabot-auto-merge
branch
from
cf77178 to
f29985c
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/branch-protection-check.yml:
- Around line 16-17: The workflow uses a floating action ref "uses:
actions/checkout@v4" and leaves persisted credentials enabled; update the
checkout step to use a pinned reference (preferably an exact tag or commit SHA
instead of `@v4`) and disable persisted credentials by setting the checkout step's
"persist-credentials" input to false so the action is both pinned and does not
leak repository credentials (locate the checkout step that currently uses
actions/checkout@v4).
- Around line 66-68: The validator currently reads on = wf.get("on") and assumes
the workflow key is the string "on", but YAML may parse an unquoted on: as
boolean True so wf.get("on") can be None; change the lookup to check both keys
(e.g., prefer "on" if present, else check for True) before validating type and
presence of "pull_request_target". Update the logic around the wf variable where
on is fetched so it sets on = wf.get("on") or wf.get(True) (or equivalent
key-existence check), then keep the existing type check and
fail("dependabot-auto-merge.yml must use pull_request_target trigger") when on
is not a dict or missing "pull_request_target".
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 3326300a-4c5e-4c32-9030-f3e56be835b7
📒 Files selected for processing (2)
.github/workflows/branch-protection-check.yml.github/workflows/dependabot-auto-merge.yml
| - name: Checkout code | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify checkout refs and credential persistence settings in workflows
rg -n -C2 'uses:\s*actions/checkout@' .github/workflows/*.yml
rg -n -C2 'persist-credentials' .github/workflows/*.ymlRepository: openshift/managed-velero-operator
Length of output: 457
Pin actions/checkout and disable persisted credentials.
Line 17 uses a floating action ref (@v4), and checkout persists credentials by default. This is a workflow hardening gap and may violate pinned-action compliance policies.
Suggested patch
- name: Checkout code
- uses: actions/checkout@v4
+ uses: actions/checkout@<full-length-commit-sha>
+ with:
+ persist-credentials: false🧰 Tools
🪛 zizmor (1.25.2)
[warning] 16-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/branch-protection-check.yml around lines 16 - 17, The
workflow uses a floating action ref "uses: actions/checkout@v4" and leaves
persisted credentials enabled; update the checkout step to use a pinned
reference (preferably an exact tag or commit SHA instead of `@v4`) and disable
persisted credentials by setting the checkout step's "persist-credentials" input
to false so the action is both pinned and does not leak repository credentials
(locate the checkout step that currently uses actions/checkout@v4).
| on = wf.get("on") | ||
| if not isinstance(on, dict) or "pull_request_target" not in on: | ||
| fail("dependabot-auto-merge.yml must use pull_request_target trigger") |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 -m pip install --quiet pyyaml
python3 <<'PY'
from pathlib import Path
import yaml
wf = yaml.safe_load(Path(".github/workflows/dependabot-auto-merge.yml").read_text())
print("Top-level keys:", list(wf.keys())[:5])
print("'on' key exists:", "on" in wf)
print("True key exists:", True in wf)
PYRepository: openshift/managed-velero-operator
Length of output: 176
🏁 Script executed:
fd "branch-protection-check.yml" --type fRepository: openshift/managed-velero-operator
Length of output: 59
🏁 Script executed:
cat -n ".github/workflows/branch-protection-check.yml"Repository: openshift/managed-velero-operator
Length of output: 4239
🏁 Script executed:
# Check the dependabot-auto-merge.yml file to see the actual structure
cat -n ".github/workflows/dependabot-auto-merge.yml"Repository: openshift/managed-velero-operator
Length of output: 11820
Fix on trigger parsing in the validator script.
With yaml.safe_load, unquoted workflow key on: is parsed as boolean True, so wf.get("on") returns None and valid workflows fail this check. The validator needs to check for the boolean key as a fallback.
Suggested patch
- on = wf.get("on")
- if not isinstance(on, dict) or "pull_request_target" not in on:
+ on_section = wf.get("on")
+ if on_section is None and True in wf:
+ on_section = wf[True]
+ if not isinstance(on_section, dict) or "pull_request_target" not in on_section:
fail("dependabot-auto-merge.yml must use pull_request_target trigger")📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| on = wf.get("on") | |
| if not isinstance(on, dict) or "pull_request_target" not in on: | |
| fail("dependabot-auto-merge.yml must use pull_request_target trigger") | |
| on_section = wf.get("on") | |
| if on_section is None and True in wf: | |
| on_section = wf[True] | |
| if not isinstance(on_section, dict) or "pull_request_target" not in on_section: | |
| fail("dependabot-auto-merge.yml must use pull_request_target trigger") |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/branch-protection-check.yml around lines 66 - 68, The
validator currently reads on = wf.get("on") and assumes the workflow key is the
string "on", but YAML may parse an unquoted on: as boolean True so wf.get("on")
can be None; change the lookup to check both keys (e.g., prefer "on" if present,
else check for True) before validating type and presence of
"pull_request_target". Update the logic around the wf variable where on is
fetched so it sets on = wf.get("on") or wf.get(True) (or equivalent
key-existence check), then keep the existing type check and
fail("dependabot-auto-merge.yml must use pull_request_target trigger") when on
is not a dict or missing "pull_request_target".
|
@MitaliBhalla: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Summary
Dependabot auto-merge for routine updates (ROSA-745 / ROSAENG-751), aligned with openshift/backplane-cli (SREP-2438).
Changes
pull_request_target(no PR checkout), validated GraphQL/REST/comment responses.Notes
dependabot[bot]+openshiftorg only.Test plan
Made with Cursor
Summary by CodeRabbit