ci: run the Dependabot auto-merge in the base branch context - #595
Conversation
Triggered on pull_request the job receives Dependabot secrets, so RELEASER_APP_ID is empty and the App token step fails on every Dependabot pull request. Switch to pull_request_target, drop the checkout that context must never do, pin the actions to commits, and disarm auto-merge when someone other than Dependabot moves the head.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Warning Review limit reachedNext included review available in 20 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (1)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe Dependabot auto-merge workflow now runs on ChangesDependabot auto-merge workflow
Estimated code review effort: 3 (Moderate) | ~20 minutes Merge Risk: ⚪ Minimal · up to Dependabot auto-merge now runs with the required base-branch secret access while pinning actions, limiting default permissions, and preventing approval or merge of a changed head commit. The change is ready to merge. Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant GitHubAPI
participant PullRequest
GitHubActions->>GitHubAPI: Read autoMergeRequest and headRefOid
GitHubAPI->>PullRequest: Return auto-merge state and head SHA
GitHubActions->>GitHubAPI: Disable auto-merge if the head changed
GitHubActions->>GitHubAPI: Submit approval for the inspected head SHA
GitHubActions->>PullRequest: Merge with the matching head commit
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
A rerun keeps github.actor as whoever caused the original event, so the attempt counter and triggering_actor checks only made reruns skip both paths: a failed disarm of a foreign push stayed armed, and a failed Dependabot run could not be rerun into its approval.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 032b9590c6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # someone else, on the first attempt and on every rerun alike; a failed | ||
| # first attempt is retried into the same branch, not skipped. | ||
| - name: Disarm auto-merge when someone else moved the head | ||
| if: github.actor != 'dependabot[bot]' |
There was a problem hiding this comment.
When a maintainer reopens a Dependabot PR, github.actor is the maintainer even though the head did not move, so this condition selects the disarm path and the metadata step is subsequently skipped. Because reopened remains a configured trigger and closing a PR disarms auto-merge, an otherwise eligible reopened minor/patch update will never be approved or auto-merged until Dependabot happens to push another commit; distinguish reopened from a foreign synchronize event and evaluate the unchanged Dependabot head.
Useful? React with 👍 / 👎.
1 participant
Summary
Every Dependabot pull request here shows a failing
auto-mergecheck: triggered onpull_request, the job receives Dependabot secrets instead of Actions secrets, soRELEASER_APP_IDresolves to an empty string and the App token step fails (The 'client-id' (or deprecated 'app-id') input must be set).The workflow is replaced with the one already proven in structured-email-address and structured-public-domains:
pull_request_target(base-branch context, where the secrets exist), no checkout at all, actions pinned to commits because that context can reach the App key, approval and auto-merge bound to the inspected head SHA, and auto-merge disarmed when someone other than Dependabot pushes to the branch.Testing
Takes effect for Dependabot pull requests opened or updated after merge; the next
@dependabot rebaseon any open update exercises it.Summary by CodeRabbit