Repository navigation
ci(dependabot): weekly grouped updates and shared auto-merge for minor and patch - #106
Conversation
Individual dependabot PRs pile up faster than one engineer can review them and go stale until they conflict (bbot-enterprise#141). Every ecosystem now runs weekly against dev and opens at most two grouped PRs: one for minor and patch bumps, one for majors. A pull_request_target workflow enables auto-merge (squash) on the minor/patch group so it lands once required checks pass. Majors still need a human.
The auto-merge job was a byte-identical copy in ten repositories. It now calls dependabot-auto-merge.yml in blacklanternsecurity/.github, pinned by SHA, so the fetch-metadata pin and merge policy live in one place. The trigger moves from pull_request_target to pull_request. Dependabot branches live in this repository, so the privileged target context was never needed and zizmor flags it as a dangerous trigger. The cargo ecosystem also scans /benchmark, which carries its own Cargo.toml and Cargo.lock that were previously never updated.
blacklanternsecurity/.github is private, so public repositories cannot call reusable workflows from it and the run failed as a workflow file issue. The shared workflow lives in blacklanternsecurity/CLA, which is public and already hosts cla-reusable.yml.
dev carries no required checks (#139), so gh pr merge --auto would merge immediately rather than on green. The shared workflow now waits for every other check on the head commit, refuses on failure or cancel, and merges with --match-head-commit. The caller grants checks: read so it can read check state.
Aligns with the SHA the other shared CLA workflows are pinned to. The auto-merge workflow is unchanged between the two commits.
…-automerge # Conflicts: # .github/dependabot.yml
singlerider
added
dependencies
RadixTarget Benchmark Results100000 networks per table, 100000 lookups, median of 5 runs (seed 1337).
Change is in time taken: negative is faster. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## dev #106 +/- ##
===================================
Coverage 100% 100%
===================================
Files 3 3
Lines 605 605
===================================
Hits 605 605 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
liquidsec
left a comment
liquidsec
left a comment
There was a problem hiding this comment.
Blocking: the pinned SHA (e532142) never merges anything. It filters out its own check by workflow name, but when the caller isn't on the default branch GitHub reports that name as the file path, so the job waits on itself until the 3h timeout. This is happening on cloudcheck's Dependabot PRs now. Please re-pin to CLA main, ad6e7d77546f99f569e51085a0e7aad496e23b9c (CLA#7). That also fixes e532142 not being on main, despite what the description says.
Nit: the "Depends on" and "CI" sections of the description are out of date now that CLA#3 has merged.
The e532142 pin filtered its own check by workflow name. Off the default branch GitHub reports that name as the file path, so the job waited on itself until the 3h timeout and never merged. CLA#7 drops the check by run id instead, and is on CLA main.
|
@liquidsec re-pinned to CLA |
liquidsec
left a comment
liquidsec
left a comment
There was a problem hiding this comment.
Approved, but I believe this wont actually work until dev no longer has review requirement.
Supersedes #97, reopened from an upstream branch.
Refs blacklanternsecurity/bbot-enterprise#141.
Change
.github/dependabot.yml:cargo,uv,github-actionseach run weekly againstdev, grouped into one minor/patch PR and one major PR per ecosystem.cargonow also scans/benchmark, which has its own Cargo.toml and Cargo.lock..github/workflows/dependabot-auto-merge.ymlis a caller stub for the sharedblacklanternsecurity/CLA/.github/workflows/dependabot-auto-merge.yml(public repo, so public callers can reach it), pinned by SHA to CLAmain. On non-major Dependabot PRs the shared workflow waits for every other check on the head commit, refuses on fail or cancel, then runsgh pr merge --squash --match-head-commit. The caller grantschecks: read. No per-repo copy of the logic.pull_request, notpull_request_target. Dependabot branches are same-repo, so the privileged context is unnecessary.Depends on
mainatad6e7d7(CLA#7). The earliere532142pin filtered its own check by workflow name, which GitHub reports as the file path off the default branch, so the job waited on itself until the 3h timeout.devcurrently requires 1 approving review, so the merge step is refused untildevmatches the approved publishing policy (D11: pull request plus passing CI, 0 approvals), tracked in blacklanternsecurity/.github-config#16. Bot auto-merge intodevon CI alone is open decision D10 there.Validation