Write down what the first real run found about its own runner - #133
Merged
Conversation
The scheduled cloud runner is not a developer machine, and the prompt assumed it was. Five corrections, all observed in the first MODE=merge run: - `gh` is not installed there. The document is written in `gh` commands because they state clearly what to fetch, so keep them, but say up front that they may need translating: MCP tools for mutations, plain curl for bulk reads. The run worked this out unaided; that was luck, and luck is not a specification. - curl reaches only repository-scoped endpoints. `/advisories` returns "sessions are bound to their configured repositories", so the security check now goes through `npm audit --package-lock-only`, which needs neither network nor auth. Read it both ways: an advisory against the incoming version blocks a merge, one against the outgoing version promotes an upgrade that was only Needs refresh. - npm there is 10.9.7, so the allow-scripts note describes something that cannot happen. Scoped to npm 11+. - The GitHub MCP comment tool appends an AI attribution trailer, which CLAUDE.md forbids. Posting is therefore not the last step: read the comment back and edit the trailer off. Fifteen comments from the first run have been corrected. - Auto-merge refuses a PR that is already green, saying to merge directly. That is the expected answer, not a failure, and the document now says so rather than leaving a run to guess.
Contributor
🟢 Impact Analysis — PR #133Risk tier: 🟢 LOW 📊 Summary
🎯 Risk Factors
📦 Modules Affectedci-workflows (1 file)
This report is generated automatically for every PR. See #733 for details. |
Contributor
🛫 PR Readiness Check
PR Scope: 🔧 Infrastructure
|
| Status | Check | Details |
|---|---|---|
| ✅ | Single commit | 1 commit — clean history |
| ✅ | Not in draft | Ready for review |
| ✅ | Branch up to date | Up to date with dev |
| ❌ | Copilot review | No Copilot review yet — it may still be processing |
| ✅ | Changeset present | No source files changed — changeset not required |
| ✅ | Scope clean | No .squad/ or docs/proposals/ files |
| ✅ | No merge conflicts | No merge conflicts |
| ✅ | Copilot threads resolved | No Copilot review threads |
| ✅ | CI passing | All checks passing |
Files Changed (1 file, +54 −1)
| File | +/− |
|---|---|
.github/prompts/dependabot-review.md |
+54 −1 |
Total: +54 −1
This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #132, from the first
MODE=mergerun of the routine (session, 62 turns, 888s). That run merged #131, #129 and #90 and commented on all 14 open Dependabot PRs, so the rules held up — but it also exposed five things the prompt got wrong about the environment it actually runs in.ghis not installed in the cloud runnercurlfor bulk reads/advisoriesis blocked — "sessions are bound to their configured repositories"npm audit --package-lock-onlyfor the security signalallow-scriptsnote to npm 11+CLAUDE.mdforbids itOn (1)
The run recovered on its own — it probed for
gh, found none, and switched tomcp__github__*plus unauthenticated REST. That worked, but nothing in the document told it to, and a run that improvises its way around a missing tool can equally improvise its way around a safety rule. Theghcommands stay, since they are the clearest statement of what to fetch; what is new is a table saying which transport to use for what, and that thecurlpath is read-only and repo-scoped.On (4)
Not cosmetic —
CLAUDE.mdrequires no AI attribution in comments or PR bodies, and the MCP tool appended_Generated by [Claude Code]_to all 15 comments. Those 15 are already corrected in place; this change stops it recurring. The instruction is bounded: read back, edit once, and if the edit re-appends the trailer, report it rather than looping.What the run got right, unchanged here
Preferred
--autobefore a direct merge; re-ran discovery between merges; validated #90 in a throwaway worktree and cleaned it up; stopped at the 3-merge cap. It also correctly separated #130's Docker/Aspire test failure (infrastructure) from #124'sGitHub.Copilot.SDKfailure (a real build break), which is the distinction section 8 exists to make.Validation
npm run check:docspasses.