feat(ci): add Dependabot + safe automerge for GitHub Actions - #168
Conversation
Latest patch release; supersedes the v7.0.0 pin merged with the static-site rebuild.
Reintroduces automated dependency updates and automerge — the site's prior React/Vite architecture had both (ci/scheduled-automerge-and-resume-workflow, fix/automerge-author-login), but they were removed along with the Node build pipeline when the site was rebuilt as static HTML. The dependency surface today is just 4 SHA-pinned GitHub Actions, so this is scoped to the github-actions ecosystem only — there is no npm/pnpm surface to track. Design changes vs. the old workflow (not a mechanical port): - Uses dependabot/fetch-metadata instead of regex-matching `author.login` against "dependabot[bot]" — the old approach broke when GitHub changed the login format to "app/dependabot" (fix/automerge-author-login was a patch for that exact fragility). - Uses native `gh pr merge --auto --squash`, which defers to GitHub's own required-status-check gating, instead of grepping `gh pr checks` output for job names like "Lint|Typecheck|Build|Test" that no longer exist in the single-job static-site CI. - Runs on GITHUB_TOKEN, not a custom CI_GITHUB_TOKEN PAT. - Major-version action bumps are excluded from automerge and require manual review.
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
Warning Review limit reached
Next review available in: 55 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![amazon-q-developer[bot]](https://avatars.githubusercontent.com/in/1220912?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review Summary
This PR introduces Dependabot automation for GitHub Actions dependencies with automated merging for patch/minor updates. While the overall approach is sound, there are two critical blocking issues that must be resolved before merge:
Critical Issues Requiring Fixes:
- Security vulnerability: The
pull_request_targettrigger with write permissions creates a privilege escalation risk that could allow malicious code execution in the repository's context - Logic error: The workflow will fail because
GITHUB_TOKENcannot approve its own PR due to GitHub's circular dependency protection
What Works Well:
- Dependabot configuration is properly scoped to
github-actionsecosystem only - Update grouping and commit message conventions are well-configured
- Auto-merge correctly excludes major version updates
- Actions are SHA-pinned for supply chain security
actions/checkoutbumps to v7.0.1 are correct
Please address the two critical issues identified in the inline comments.
You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.
| name: Automerge | ||
|
|
||
| on: | ||
| pull_request_target: |
There was a problem hiding this comment.
🛑 Security Vulnerability: Using pull_request_target with write permissions creates a privilege escalation risk. This trigger runs workflows in the context of the base repository with access to secrets, even for PRs from forks. While the if: github.actor == 'dependabot[bot]' check provides some mitigation, a compromised Dependabot action or a race condition could still allow malicious code execution with write access to the repository.1
Switch to the pull_request trigger instead. The workflow will still have access to GITHUB_TOKEN with sufficient permissions for Dependabot PRs since Dependabot PRs originate from the same repository, not external forks.
| pull_request_target: | |
| pull_request: |
Footnotes
-
CWE-669: Incorrect Resource Transfer Between Spheres - https://cwe.mitre.org/data/definitions/669.html ↩
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| PR_URL: ${{ github.event.pull_request.html_url }} | ||
| run: | | ||
| gh pr review "$PR_URL" --approve |
There was a problem hiding this comment.
🛑 Logic Error: The workflow will fail when attempting to auto-approve Dependabot PRs. GitHub Actions does not allow a workflow run triggered by GITHUB_TOKEN to approve its own PR - this creates a circular dependency that GitHub explicitly blocks to prevent automation abuse.1
Add a dedicated bot token with PR approval permissions to secrets (e.g., DEPENDABOT_AUTO_MERGE_TOKEN), or remove the approval step and rely solely on branch protection rules requiring reviews from CODEOWNERS.
Footnotes
-
CWE-670: Always-Incorrect Control Flow Implementation - https://cwe.mitre.org/data/definitions/670.html ↩
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ab4bf84743
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - name: Approve and enable auto-merge (patch/minor only) | ||
| if: steps.metadata.outputs.update-type != 'version-update:semver-major' | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
There was a problem hiding this comment.
GH_TOKEN is the token gh uses for API authentication (CLI environment documentation), and GitHub suppresses workflow runs caused by the repository GITHUB_TOKEN except for dispatch events (GitHub token documentation). Since .github/workflows/cd.yml deploys only on a push to main, a Dependabot PR auto-merged with this token will not start CD, so that main commit is never deployed. Authenticate the merge with a PAT or GitHub App token, as the repository's prior automerge workflow did, or explicitly run deployment through the same workflow.
Useful? React with 👍 / 👎.
…ning (#169) * chore: remove stale CODEOWNERS entries for deleted directories /.cursor/ and /docs/ don't exist anywhere in the tracked tree (verified via git ls-tree) — leftover from a prior repo state. GitHub silently no-ops on non-existent CODEOWNERS paths, so this wasn't a functional break, but it's misleading to a contributor reading the file. The existing `* @jbdevprimary` and `*.md @jbdevprimary` rules already cover everything that actually exists. Found by a post-merge dangling-references sweep of the repo. * fix(ci): harden automerge PR-author check and drop redundant approval A security review of the automerge workflow (PR #168) found: 1. `github.actor` reflects who triggered the current event, not the PR author — the wrong field for this gate. Switched to `github.event.pull_request.user.login`, the pattern dependabot/fetch-metadata's own README uses in every example, and added the `github.repository ==` guard from the same examples. 2. dependabot/fetch-metadata calls `core.setFailed(...)` (not `setFailed` propagating a hard stop by itself, but a failed step) when the PR isn't genuinely from Dependabot or its commit signature isn't verified — GitHub Actions skips subsequent steps in the job by default after a failed step, so the approve/merge step was already unreachable in that case. Added an explicit non-empty check on `update-type` anyway so the gate doesn't depend on that implicit, third-party-owned fail-closed behavior. 3. Verified live branch protection on `main`: there is no required-review rule configured (`required_pull_request_reviews` is absent; the only ruleset's rules are `copilot_code_review` and `code_quality`, which explicitly exclude `main`). `gh pr review --approve` was therefore satisfying no actual gate — a bot self-approving a PR with zero protective effect. Removed it; only `gh pr merge --squash --auto` (gated by required status checks) remains.
1 participant
Summary
Consolidates the intent of two stale branches (
ci/scheduled-automerge-and-resume-workflow,fix/automerge-author-login) that predate the static-site rebuild, redesigned for today's architecture rather than mechanically ported..github/dependabot.ymlscoped to thegithub-actionsecosystem only. The current dependency surface is exactly 4 SHA-pinned actions — there's no npm/pnpm surface to track anymore..github/workflows/automerge.ymlusingdependabot/fetch-metadata+ nativegh pr merge --auto --squash, gated by branch protection requiring theStatic site validationcheck (now configured onmain).actions/checkoutto v7.0.1 (latest patch).Why not a mechanical port of the old workflow
The old
automerge.yml(from the pre-rebuild branches):author.login == "dependabot[bot]"by regex, which broke when GitHub changed the login format to"app/dependabot"—fix/automerge-author-loginwas a patch for that exact fragility.dependabot/fetch-metadatareplaces this with GitHub's own supported mechanism.gh pr checksoutput for job names matchingLint|Typecheck|Build|Test, none of which exist in the current single-jobstatic-siteCI. Native auto-merge defers to GitHub's required-status-check gating instead of hardcoded job-name matching.CI_GITHUB_TOKENPAT. The new workflow usesGITHUB_TOKEN.Test plan
no Node pipeline, asset presence, no CDN deps) pass unchangedmainrequiringStatic site validation