Add Dependabot auto-merge workflows (ROSA-745)#615
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds a weekly/manual branch-protection verification workflow and a Dependabot-targeted auto-merge workflow that enables squash auto-merge for patch/minor/digest updates via GraphQL and posts REST comment fallbacks (major updates block). ChangesDependency Management Automation via GitHub Actions
Sequence Diagram(s)sequenceDiagram
participant DependabotPR as Dependabot PR
participant Actions as GitHub Actions (auto-merge job)
participant REST as GitHub REST API
participant GraphQL as GitHub GraphQL API
DependabotPR->>Actions: trigger auto-merge job (pull_request_target)
Actions->>REST: GET PR to obtain node_id
REST-->>Actions: returns node_id
Actions->>GraphQL: enablePullRequestAutoMerge(node_id, mergeMethod: SQUASH)
GraphQL-->>Actions: success / error
alt GraphQL failure
Actions->>REST: POST warning comment to PR (includes update type, dependency, versions)
REST-->>Actions: comment response
else semver-major
Actions->>REST: POST "Major Version Update Detected" comment (step fails on non-2xx)
REST-->>Actions: comment response
end
Actions->>Actions: log decision summary (enabled / disabled)
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/dependabot-auto-merge.yml:
- Around line 25-29: The "Check PR Labels" step (id: check-labels) currently
hardcodes the output has-required-labels=true which bypasses the label gating
used later; change this step to compute has-required-labels from the actual PR
labels (e.g., inspect github.event.pull_request.labels or use the GitHub CLI /
actions/github-script) and set the output to true only if the required labels
are present, so downstream checks that reference has-required-labels (the later
steps that gate auto-merge) behave correctly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: c6de5b8f-2b31-4b07-9131-5b80a1fdcc0f
📒 Files selected for processing (2)
.github/workflows/branch-protection-check.yml.github/workflows/dependabot-auto-merge.yml
MitaliBhalla
force-pushed
the
chore/dependabot-auto-merge
branch
from
0abc355 to
3fe33b1
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/dependabot-auto-merge.yml:
- Around line 62-71: The curl call that sets PR_NODE_ID should also capture the
HTTP status and response body so we can detect 4xx/5xx errors and log them
instead of silently letting jq produce "null"; modify the curl invocation that
populates PR_NODE_ID to write the HTTP status (e.g., via --write-out
%{http_code}) and capture both the body and status into variables, then check
the status before running jq, and if it's not 200 log the HTTP status and body
(including GH_TOKEN redaction if needed) and exit non-zero; ensure the existing
PR_NODE_ID check remains but is only reached after a successful HTTP-status
check.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 3bf5596c-12e8-48c0-ae95-afa93ea8f4d6
📒 Files selected for processing (1)
.github/workflows/dependabot-auto-merge.yml
MitaliBhalla
force-pushed
the
chore/dependabot-auto-merge
branch
7 times, most recently
from
6d42e1c to
cb8516f
Compare
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: devppratik, MitaliBhalla The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
- dependabot-auto-merge: auto-merge patch/minor/digest after CI; majors manual - pull_request_target without PR checkout; GraphQL and comment API validation - branch-protection-check: weekly dependabot config/workflow verification Co-authored-by: Cursor <cursoragent@cursor.com>
MitaliBhalla
force-pushed
the
chore/dependabot-auto-merge
branch
from
cb8516f to
955c7af
Compare
|
New changes are detected. LGTM label has been removed. |
|
@MitaliBhalla: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Summary
Enables Dependabot auto-merge for routine dependency updates (ROSA-745 / ROSAENG-755 / ROSAENG-751), aligned with the openshift/backplane-cli pilot (SREP-2438).
Changes
dependabot-auto-merge.yml: enables auto-merge for patch, minor, and digest Dependabot PRs after required CI passes; major updates remain manual. Usespull_request_target(no checkout of PR head) with GraphQL and comment API response validation.branch-protection-check.yml: weekly workflow to verify Dependabot config and auto-merge workflow are present.Notes
dependabot[bot]and theopenshiftorg.Test plan
Made with Cursor
Summary by CodeRabbit