fix(ci): classify Dependabot updates by metadata - #74
Conversation
|
Warning Review limit reachedNext included review available in 47 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
The refactoring from branch-name heuristics to authoritative Dependabot metadata classification is well-implemented. The PR correctly uses dependabot/fetch-metadata to determine semver update types, properly centralizes classification logic in the CI workflow, and maintains consistent SHA-pinned action hygiene across both workflow files and documentation.
The implementation correctly preserves the intended behavior: minor and patch updates skip expensive CI and enable auto-merge, while major updates receive full validation and manual review. All tests are appropriately updated to validate the new metadata-based approach.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
004f4e1 to
0a157b9
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 004f4e1f31
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| contains(github.event.pull_request.head.ref, '/non-major-')) | ||
| ) | ||
| needs: classify-pr | ||
| if: always() && needs.classify-pr.outputs.skip-expensive-ci != 'true' |
There was a problem hiding this comment.
When this workflow is manually canceled or superseded, always() remains true, so the newly guarded test job—and the quality, SonarQube, and dependency-review jobs using the same pattern—can continue or start despite cancellation. This can run the entire expensive CI suite after an operator attempted to stop it; use a cancellation-aware status check such as !cancelled() while retaining the fail-open behavior for classification failures.
Useful? React with 👍 / 👎.
|
1 participant
Summary
Validation
actionlint .github/workflows/*.ymltox -e py313(803 passed)pnpm --dir docs validate