Replace dependabot-repair.yml with agentic workflow via gh aw add#28999
Replace dependabot-repair.yml with agentic workflow via gh aw add#28999
Conversation
…abot-campaign Agent-Logs-Url: https://github.com/github/gh-aw/sessions/6eca4520-04c9-4c85-9818-d46752d62b53 Co-authored-by: mnkiefer <8320933+mnkiefer@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Replaces the legacy dependabot-repair.yml wrapper workflow with a gh-aw “agentic workflow” setup (Markdown source + compiled lock YAML) sourced from githubnext/dependabot-campaign@ff91842 (v0.2.0).
Changes:
- Delete the hand-written
.github/workflows/dependabot-repair.ymlreusable-workflow wrapper. - Add
.github/workflows/dependabot-repair.mdagentic workflow source and compile it into.github/workflows/dependabot-repair.lock.yml. - Update docs status table to include “Dependabot Local Repair”.
Show a summary per file
| File | Description |
|---|---|
| docs/src/content/docs/agent-factory-status.mdx | Adds the new Dependabot Local Repair workflow to the published workflow status table. |
| .github/workflows/dependabot-repair.yml | Removes the old wrapper workflow that invoked the upstream reusable workflow. |
| .github/workflows/dependabot-repair.md | Introduces the agentic workflow Markdown definition pointing at the upstream source SHA. |
| .github/workflows/dependabot-repair.lock.yml | Adds the compiled gh-aw lock workflow generated from the Markdown source. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 4/4 changed files
- Comments generated: 1
| @@ -0,0 +1,86 @@ | |||
| --- | |||
| description: Repair safe Dependabot PR failures locally inside a product repository. | |||
| on: | |||
There was a problem hiding this comment.
The workflow is intended to act only on Dependabot PRs (previous wrapper enforced this via if: github.actor == 'dependabot[bot]'), but the new frontmatter trigger will also run for maintainers’ PRs and may not run for Dependabot at all because agentic workflows enforce on.roles during pre-activation by default. Consider adding an explicit bot allowlist (e.g., on.bots: [dependabot[bot]]) so the workflow both (1) reliably activates for Dependabot and (2) doesn’t spend compute/noop on non-Dependabot PRs.
| on: | |
| on: | |
| bots: [dependabot[bot]] |
The
dependabot-repairtrigger was a hand-crafted GitHub Actions YAML calling a reusable workflow directly. This replaces it with the proper agentic workflow pattern, sourced fromgithubnext/dependabot-campaign@ff91842(v0.2.0).Changes
.github/workflows/dependabot-repair.yml— the rawuses: githubnext/dependabot-campaign/.github/workflows/dependabot-repair-reusable.lock.yml@<sha>wrapper.github/workflows/dependabot-repair.md— agentic markdown workflow withsource:field forgh aw updatetracking, equivalent to:.github/workflows/dependabot-repair.lock.ymlfrom the new.mdNote: trigger changes from
pull_request_target→pull_request— this is intentional and matches the upstream design; the agentic framework supplies its own token (COPILOT_GITHUB_TOKEN) rather than relying on elevatedpull_request_targetsecrets.