Add Dependabot auto-merge workflows (ROSA-745)#989
Open
MitaliBhalla wants to merge 1 commit into
Open
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds a Dependabot auto-merge GitHub Actions workflow that enables squash auto-merge for patch/minor/digest updates and comments for major updates, plus a weekly/manual branch-protection/config check that verifies ChangesDependabot Automation
Sequence Diagram(s)sequenceDiagram
participant Dependabot
participant ActionsRunner
participant GitHubREST
participant GitHubGraphQL
participant PullRequest
Dependabot->>ActionsRunner: PR opened (dependabot[bot])
ActionsRunner->>ActionsRunner: fetch metadata (dependabot/fetch-metadata)
ActionsRunner->>GitHubREST: GET PR to obtain node_id
alt update-type is patch/minor/digest
ActionsRunner->>GitHubGraphQL: enablePullRequestAutoMerge(node_id, SQUASH)
GitHubGraphQL-->>ActionsRunner: success/failure
alt failure
ActionsRunner->>GitHubREST: POST comment describing enable failure (|| true)
end
else update-type is semver-major
ActionsRunner->>GitHubREST: POST manual-review comment (fail on non-2xx)
end
ActionsRunner->>PullRequest: log enable/disable decision
🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 11 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: MitaliBhalla The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/dependabot-auto-merge.yml:
- Around line 75-78: The current success check only tests the HTTP status in
variable "$response" and can misreport GraphQL failures; update the script to
also inspect the JSON body written to /tmp/response.json and only treat the call
as successful if "$response" equals 200 AND the JSON has no "errors" (e.g. jq
'.errors | length == 0') AND contains the expected "data" payload for the
mutation (e.g. jq '.data.<expectedField> != null' where <expectedField> is the
GraphQL mutation/field you expect). Modify the if condition that checks
"$response" and replace it with a combined check that validates the status plus
the jq checks against /tmp/response.json, falling back to the existing else
branch when any of those validations fail.
- Around line 3-6: Change the workflow trigger from pull_request to
pull_request_target so the GITHUB_TOKEN has write permissions for auto-merge and
comment operations, and remove or restrict the current actions/checkout@v4 usage
so the job does not check out the untrusted PR head code (only fetch metadata/PR
info or omit checkout entirely); ensure any steps that mutate the repo (enable
auto-merge, post comments) run under pull_request_target and that you do not
perform a full checkout of PR code in the dependabot-auto-merge workflow.
- Around line 85-90: The two curl POST commands that create PR comments (the
requests to "https://api.github.com/repos/${{ github.repository }}/issues/${{
github.event.pull_request.number }}/comments") currently use curl -s with no
HTTP status validation; update both comment-posting curl invocations to mirror
the GraphQL request pattern by using curl -s -w "%{http_code}" -o
/tmp/response.json (or similar), capture the HTTP status, and fail the job or
log an error if the status is not 2xx, ensuring the response body is available
for diagnostics and the workflow does not silently ignore failed comment posts.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 971e46b2-28bf-4619-9846-193274a1da26
📒 Files selected for processing (2)
.github/workflows/branch-protection-check.yml.github/workflows/dependabot-auto-merge.yml
MitaliBhalla
force-pushed
the
chore/dependabot-auto-merge
branch
from
e4e1579 to
2040247
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/dependabot-auto-merge.yml:
- Line 55: The jq check in the workflow uses `.errors | length == 0`, which
fails when `.errors` is missing; update the jq filter in the existing command to
treat a missing errors field as an empty array (use the fallback operator so the
expression becomes something like using `.errors // []` and then checking its
length) so successful GraphQL responses without an `.errors` key evaluate as
success; keep the surrounding `jq -e ... /tmp/response.json >/dev/null 2>&1 ||
return 1` invocation intact.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 1d774082-825f-42a7-a600-0f6140189757
📒 Files selected for processing (1)
.github/workflows/dependabot-auto-merge.yml
MitaliBhalla
force-pushed
the
chore/dependabot-auto-merge
branch
from
2040247 to
552cc0a
Compare
There was a problem hiding this comment.
♻️ Duplicate comments (1)
.github/workflows/dependabot-auto-merge.yml (1)
55-55:⚠️ Potential issue | 🟠 Major | ⚡ Quick winGraphQL success check fails on successful responses (no
.errorsfield).When GitHub GraphQL returns a successful response, it omits the
.errorsfield entirely. The expression.errors | lengthon a missing field yieldsnull, andnull == 0isfalse, causingjq -eto exit non-zero. This incorrectly treats successful auto-merge calls as failures.Proposed fix
graphql_auto_merge_ok() { local http_code="$1" [[ "$http_code" == "200" ]] || return 1 - jq -e '.errors | length == 0' /tmp/response.json >/dev/null 2>&1 || return 1 + jq -e '(.errors // []) | length == 0' /tmp/response.json >/dev/null 2>&1 || return 1 jq -e '.data.enablePullRequestAutoMerge.pullRequest != null' /tmp/response.json >/dev/null 2>&1 }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/dependabot-auto-merge.yml at line 55, The jq check in the workflow uses the expression that assumes .errors exists, which fails when GraphQL omits .errors on success; update the jq filter on the line containing "jq -e '.errors | length == 0' /tmp/response.json" to first default a missing .errors to an empty array (using jq's alternate/default operator) and then test the length equals zero so successful responses without an errors field are treated as success.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In @.github/workflows/dependabot-auto-merge.yml:
- Line 55: The jq check in the workflow uses the expression that assumes .errors
exists, which fails when GraphQL omits .errors on success; update the jq filter
on the line containing "jq -e '.errors | length == 0' /tmp/response.json" to
first default a missing .errors to an empty array (using jq's alternate/default
operator) and then test the length equals zero so successful responses without
an errors field are treated as success.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 9ecdb027-bacf-445b-b705-9e33bdcd3f3c
📒 Files selected for processing (2)
.github/workflows/branch-protection-check.yml.github/workflows/dependabot-auto-merge.yml
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/branch-protection-check.yml
MitaliBhalla
force-pushed
the
chore/dependabot-auto-merge
branch
6 times, most recently
from
3f29cf1 to
768e115
Compare
- dependabot-auto-merge: auto-merge patch/minor/digest after CI; majors manual - pull_request_target without PR checkout; GraphQL and comment API validation - branch-protection-check: weekly dependabot config/workflow verification Co-authored-by: Cursor <cursoragent@cursor.com>
MitaliBhalla
force-pushed
the
chore/dependabot-auto-merge
branch
from
768e115 to
990d93a
Compare
Contributor
|
@MitaliBhalla: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Contributor
Author
|
On hold — pausing this per-repo workflow rollout while we switch to the boilerplate / MintMaker (Renovate) path for ROSA-745. Please do not merge; we will close or reopen after the platform PR lands. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Enables Dependabot auto-merge for routine dependency updates (ROSA-745 / ROSAENG-751), aligned with the openshift/backplane-cli pilot (SREP-2438).
Changes
dependabot-auto-merge.yml: enables auto-merge for patch, minor, and digest Dependabot PRs after required CI passes; major updates remain manual (PR comment only).branch-protection-check.yml: weekly workflow to verify Dependabot config and auto-merge workflow are present.Notes
dependabot[bot]and theopenshiftorg.Test plan
Made with Cursor
Summary by CodeRabbit