ROSA-745: per-repo dependency automation config#917
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@MitaliBhalla: This pull request references ROSA-745 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the initiative to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
WalkthroughDependabot settings for Go modules were updated, and a new workflow was added to auto-merge eligible Dependabot pull requests, comment on major updates, and log the final decision. ChangesDependabot automation
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Skipping CI for Draft Pull Request. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/dependabot.yml:
- Around line 8-24: The dependabot config's allow list currently limits updates
to only the two OpenShift packages, making the "aws-sdk" and "kubernetes" groups
unreachable; fix by either removing the top-level allow block (so groups
aws-sdk, kubernetes, openshift are evaluated), or if you want to keep allow,
remove the unused "aws-sdk" and "kubernetes" group entries, or expand the allow
list to include the specific AWS and Kubernetes dependencies you want Dependabot
to update (update the "allow" entries or adjust "groups" patterns accordingly).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 65a235ff-960e-4fe1-b170-47c04dfde7bf
📒 Files selected for processing (1)
.github/dependabot.yml
| allow: | ||
| - dependency-name: "github.com/openshift/osd-network-verifier" | ||
| - dependency-name: "github.com/openshift/backplane-cli" | ||
| schedule: | ||
| interval: 'daily' | ||
| interval: 'weekly' | ||
| open-pull-requests-limit: 10 | ||
| groups: | ||
| aws-sdk: | ||
| patterns: | ||
| - "github.com/aws/aws-sdk-go-v2*" | ||
| kubernetes: | ||
| patterns: | ||
| - "k8s.io/*" | ||
| - "sigs.k8s.io/*" | ||
| openshift: | ||
| patterns: | ||
| - "github.com/openshift/*" |
There was a problem hiding this comment.
The allow list conflicts with the groups configuration—aws-sdk and kubernetes groups are unreachable.
Dependabot's allow field restricts updates to only the listed dependencies. Currently, only two OpenShift packages are allowed:
github.com/openshift/osd-network-verifiergithub.com/openshift/backplane-cli
This means:
- The
aws-sdkgroup (line 15-17) will never trigger updates because no AWS SDK dependencies are in the allow list. - The
kubernetesgroup (line 18-21) will never trigger updates because no k8s.io or sigs.k8s.io dependencies are in the allow list. - Only the
openshiftgroup could match the two allowed dependencies.
Action required: Either:
- Remove the
allowblock entirely to enable updates for all dependencies (recommended if you want AWS SDK and Kubernetes updates), OR - Remove the unused
aws-sdkandkubernetesgroups if they're not needed, OR - Expand the
allowlist to include specific AWS and Kubernetes dependencies that should be updated.
♻️ Option 1: Remove allow block to enable all dependency updates
labels:
- "area/dependency"
- "ok-to-test"
- allow:
- - dependency-name: "github.com/openshift/osd-network-verifier"
- - dependency-name: "github.com/openshift/backplane-cli"
schedule:
interval: 'weekly'♻️ Option 2: Remove unused groups
open-pull-requests-limit: 10
groups:
- aws-sdk:
- patterns:
- - "github.com/aws/aws-sdk-go-v2*"
- kubernetes:
- patterns:
- - "k8s.io/*"
- - "sigs.k8s.io/*"
openshift:
patterns:
- "github.com/openshift/*"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| allow: | |
| - dependency-name: "github.com/openshift/osd-network-verifier" | |
| - dependency-name: "github.com/openshift/backplane-cli" | |
| schedule: | |
| interval: 'daily' | |
| interval: 'weekly' | |
| open-pull-requests-limit: 10 | |
| groups: | |
| aws-sdk: | |
| patterns: | |
| - "github.com/aws/aws-sdk-go-v2*" | |
| kubernetes: | |
| patterns: | |
| - "k8s.io/*" | |
| - "sigs.k8s.io/*" | |
| openshift: | |
| patterns: | |
| - "github.com/openshift/*" | |
| schedule: | |
| interval: 'weekly' | |
| open-pull-requests-limit: 10 | |
| groups: | |
| aws-sdk: | |
| patterns: | |
| - "github.com/aws/aws-sdk-go-v2*" | |
| kubernetes: | |
| patterns: | |
| - "k8s.io/*" | |
| - "sigs.k8s.io/*" | |
| openshift: | |
| patterns: | |
| - "github.com/openshift/*" |
| allow: | |
| - dependency-name: "github.com/openshift/osd-network-verifier" | |
| - dependency-name: "github.com/openshift/backplane-cli" | |
| schedule: | |
| interval: 'daily' | |
| interval: 'weekly' | |
| open-pull-requests-limit: 10 | |
| groups: | |
| aws-sdk: | |
| patterns: | |
| - "github.com/aws/aws-sdk-go-v2*" | |
| kubernetes: | |
| patterns: | |
| - "k8s.io/*" | |
| - "sigs.k8s.io/*" | |
| openshift: | |
| patterns: | |
| - "github.com/openshift/*" | |
| allow: | |
| - dependency-name: "github.com/openshift/osd-network-verifier" | |
| - dependency-name: "github.com/openshift/backplane-cli" | |
| schedule: | |
| interval: 'weekly' | |
| open-pull-requests-limit: 10 | |
| groups: | |
| openshift: | |
| patterns: | |
| - "github.com/openshift/*" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/dependabot.yml around lines 8 - 24, The dependabot config's allow
list currently limits updates to only the two OpenShift packages, making the
"aws-sdk" and "kubernetes" groups unreachable; fix by either removing the
top-level allow block (so groups aws-sdk, kubernetes, openshift are evaluated),
or if you want to keep allow, remove the unused "aws-sdk" and "kubernetes" group
entries, or expand the allow list to include the specific AWS and Kubernetes
dependencies you want Dependabot to update (update the "allow" entries or adjust
"groups" patterns accordingly).
MitaliBhalla
force-pushed
the
rosa-745-dependency-config
branch
from
e675d6a to
e00af72
Compare
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: MitaliBhalla The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/dependabot-auto-merge.yml (1)
7-12: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winTrim the unused token scopes.
checks: readandactions: readare not used by any visible step. Ifdependabot/fetch-metadatadoes not require them, drop these scopes to keep the workflow least-privileged.🔐 Proposed permission tightening
permissions: contents: write pull-requests: write - checks: read - actions: readAs per path instructions, "Least privilege: minimize GITHUB_TOKEN permissions."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/dependabot-auto-merge.yml around lines 7 - 12, The workflow permissions in dependabot-auto-merge are over-scoped; remove the unused checks: read and actions: read token permissions from the top-level permissions block. Keep only the scopes actually needed by the visible steps and by dependabot/fetch-metadata if required, so the workflow stays least-privileged.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/dependabot-auto-merge.yml:
- Around line 19-24: The workflow step currently checks out the repository
unnecessarily and uses a floating version for dependabot/fetch-metadata. Remove
the actions/checkout step from the dependabot auto-merge job, since the metadata
step only needs GitHub API access and outputs from dependabot/fetch-metadata.
Update the dependabot/fetch-metadata reference to a pinned full SHA in the
metadata step so the workflow uses an immutable action version.
- Around line 68-82: The auto-merge step in the workflow can report success from
`curl` based on HTTP 200 alone, but the GitHub GraphQL API may still return an
`errors` payload. Update the logic around the `response`/`/tmp/response.json`
check to inspect the response body for GraphQL `errors` before printing the
success message, and only treat the `enablePullRequestAutoMerge` mutation as
successful when the body confirms it actually enabled auto-merge.
---
Nitpick comments:
In @.github/workflows/dependabot-auto-merge.yml:
- Around line 7-12: The workflow permissions in dependabot-auto-merge are
over-scoped; remove the unused checks: read and actions: read token permissions
from the top-level permissions block. Keep only the scopes actually needed by
the visible steps and by dependabot/fetch-metadata if required, so the workflow
stays least-privileged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 4bf15f12-e29b-4568-b511-b5f44a8416ff
📒 Files selected for processing (2)
.github/dependabot.yml.github/workflows/dependabot-auto-merge.yml
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/dependabot.yml
MitaliBhalla
force-pushed
the
rosa-745-dependency-config
branch
from
e00af72 to
6d2c9c0
Compare
|
Addressed CodeRabbit review in latest push:
Thanks @coderabbitai |
|
Tip For best results, initiate chat on the files or code changes.
Appreciate the follow-up. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/dependabot-auto-merge.yml:
- Around line 80-84: The comment-posting steps in the dependabot auto-merge
workflow currently treat a successful curl invocation as a sent notification
even when GitHub returns 4xx/5xx, so the major-update and auto-merge-failure
comments can be skipped silently. Update both comment POST commands in the
workflow to verify the HTTP response status before proceeding, and make them
fail unless the response is the expected success status (or at least a 2xx). Use
the existing comment-posting logic around the GitHub issues comments API call to
ensure the workflow only marks notifications as sent after a confirmed
successful post.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 96401fc9-5009-460b-891b-92bcdf75b82a
📒 Files selected for processing (2)
.github/dependabot.yml.github/workflows/dependabot-auto-merge.yml
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/dependabot.yml
MitaliBhalla
force-pushed
the
rosa-745-dependency-config
branch
from
6d2c9c0 to
60e96e9
Compare
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
|
@MitaliBhalla: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
There was a problem hiding this comment.
GitHub has an example of doing this here, which looks a bit simpler. Should we follow this? https://docs.github.com/en/code-security/tutorials/secure-your-dependencies/automate-dependabot-with-actions#enabling-automerge-on-a-pull-request
3 participants
Summary
ROSA-745 — align osdctl Dependabot with the backplane-cli pilot path.
Keeps the existing allow-list (
osd-network-verifier,backplane-cli); addsarea/dependency, weekly schedule, gomod groups, and GHA auto-merge for safe updates.Draft — merge after openshift/release#80263 is live (~6h branch-protector cycle).
Depends on
ci/prow/build,format,lint,test,verify-docsTest plan
Summary by CodeRabbit