ci: build/test Dependabot PRs #6
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
ipscope/.github/workflows/deps-ci.yml
Lines 19 to 21 in 3d01b83
Fail PR if go mod tidy alters module files
The workflow runs go mod tidy and then builds/tests, but it never asserts that tidy left go.mod and go.sum unchanged. For Dependabot updates that only touch go.mod, go mod tidy will silently rewrite go.sum, the build will succeed, and the PR can merge while the repository still contains stale module files. Downstream developers or other CI jobs that do not run go mod tidy will then see build failures or checksum errors. Add a step after tidy (e.g. git diff --exit-code) so PRs fail when module files need to be committed.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
No description provided.