Split dependabot-dismiss tooling into composite action + thin wrapper#7
Merged
Merged
Conversation
Extract the dependency-analysis pipeline out of the reusable workflow's dismiss job into a composite action that is the single source of truth, and reduce the workflow to a checkout-then-delegate wrapper. This gives two entry points from one implementation: - Reusable workflow (unchanged interface) for the 20+ thin callers. - Composite action, called directly, for projects that must run their own pre-steps between checkout and the analysis (e.g. a Vault fetch for a private Maven repo URL), which a reusable workflow can't accept. The action resolves the pipeline scripts via $GITHUB_ACTION_PATH, removing the separate tooling-repo token mint and tooling checkout. It self-gates on the open-alert count so direct callers skip the heavy work when nothing is open; the wrapper keeps its list-alerts gate to avoid checkout when idle. The LFS gradle-wrapper materialization is preserved. README documents both usages and when to use each.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR refactors the “dismiss dev-only Dependabot alerts” automation by moving the analysis/dismissal pipeline into a shared composite action and reducing the existing reusable workflow to a thin wrapper that checks out the caller repo and invokes that action. This enables caller repositories to insert custom pre-steps (e.g., Vault fetches) between checkout and Gradle configuration while keeping a simple reusable-workflow entry point for the common case.
Changes:
- Added a new composite action (
.github/actions/dismiss-dev-only-dependabot-alerts/action.yml) that encapsulates the full pipeline and self-gates on open-alert count. - Simplified the reusable workflow (
.github/workflows/dismiss-dev-only-dependabot-alerts.yml) to: mint checkout token → checkout caller (incl. submodules) → run the composite action. - Updated
README.mdto document the new architecture and provide both “reusable workflow” and “direct action” usage patterns.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| README.md | Documents the new composite-action “engine” + reusable-workflow wrapper architecture and adds a direct-action usage example. |
| .github/workflows/dismiss-dev-only-dependabot-alerts.yml | Refactors the workflow to delegate the analysis/dismissal logic to the new composite action. |
| .github/actions/dismiss-dev-only-dependabot-alerts/action.yml | Introduces the composite action that runs the full pipeline against an already-checked-out workspace and self-gates on open alerts. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Comment on lines
+107
to
+113
| - name: Resolve scripts directory | ||
| if: steps.alerts.outputs.has-alerts == 'true' | ||
| shell: bash | ||
| # This action lives at `.github/actions/dismiss-dev-only-dependabot-alerts`, | ||
| # so the pipeline scripts at the repo root are three levels up. Resolving | ||
| # them via $GITHUB_ACTION_PATH means we need no separate tooling checkout. | ||
| run: echo "SCRIPTS_DIR=$(cd "$GITHUB_ACTION_PATH/../../../scripts" && pwd)" >> "$GITHUB_ENV" |
Comment on lines
3
to
6
| on: | ||
| push: | ||
| paths: | ||
| - "scripts/**" | ||
| - ".github/workflows/test-scripts.yml" | ||
| pull_request: | ||
| paths: | ||
| - "scripts/**" | ||
| - ".github/workflows/test-scripts.yml" | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Splits the dev-only Dependabot dismiss tooling into a shared composite action (the engine) plus a thin reusable-workflow wrapper that calls it. One implementation, two entry points.
Why
The reusable workflow can't accept caller-provided
uses:steps. Two projects need project-specific setup between checkout and Gradle configuration (a Vault fetch that supplies a private Maven repo URL), so they can't use it. Rather than bolting asetup-commandhook onto the workflow, the pipeline becomes a composite action those projects can call directly with their own pre-steps.Changes
.github/actions/dismiss-dev-only-dependabot-alerts/action.yml—using: composite, the single source of truth. Assumes the caller repo is already checked out; does no checkout and no secret setup.app-private-keyis an input (composite actions have nosecrets:block; still masked when passed from a secret). Resolves the pipeline scripts via$GITHUB_ACTION_PATH, which removes the old tooling-repo token mint + tooling checkout entirely. Self-gates on the open-alert count viasteps.alerts.outputs.has-alerts..github/workflows/dismiss-dev-only-dependabot-alerts.yml—workflow_callinterface unchanged.list-alertsgate kept as-is (skips checkout when idle).dismissjob reduced from ~250 lines to: mint token → checkout caller (submodules: recursive) →uses:the action@main.scripts/untouched. LFS gradle-wrapper materialization preserved (moved into the action).There is intentional, documented duplication: the wrapper mints a token for checkout and the action mints its own for the API; the alerts fetch happens in
list-alertsand again in the action's self-gate. Both are cheap and keep the action self-contained for direct callers.Note on the
@mainrefThe wrapper references the action at
@main. Sinceaction.ymllands onmainonly when this PR merges, an end-to-end run of the reusable-workflow path can't be validated from a caller until after merge (the action won't resolve onmainbefore then). Verify via the direct-action path pre-merge, or temporarily point a test caller at the feature ref.Verification (not yet run)
Both files parse; orchestration YAML is only truly verified by execution:
Android-RBA(dry-run) → Vault step runs, Gradle configures past "You must specify a URL for a Maven repository", analysis completes.Out of scope (separate repos / tracked separately): migrating
Android-RBAandandroid-rba-mbizto the direct action; thembizbuild/dependabot-toolscollision when Gradle clearsrootProject.buildDir.🤖 Generated with Claude Code