fix: add github-actions ecosystem to dependabot config#76
Conversation
Adds the required github-actions ecosystem entry to .github/dependabot.yml per the org dependabot policy standard. Uses weekly schedule with version updates enabled (limit 10) for CI actions currency. Closes #53 Co-authored-by: Don Petry <don-petry@users.noreply.github.com>
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Adds a repository-level Dependabot configuration to satisfy the org compliance requirement to track GitHub Actions updates.
Changes:
- Introduces
.github/dependabot.ymlwith agithub-actionsecosystem entry. - Configures weekly update cadence, PR limit (10), and default labels (
security,dependencies).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 385dde66f5d9f072ddfee3ca0bceba10acbdcf0d
Review mode: triage-approved (single reviewer)
Summary
Adds a new .github/dependabot.yml (11 lines, 1 file) containing a single github-actions ecosystem entry. The configuration matches the org dependabot-policy.md GitHub Actions template exactly — weekly schedule, open-pull-requests-limit: 10, and labels security + dependencies. No code, workflows, secrets, or runtime behavior are affected; this is config-only and confined to Dependabot's view of CI actions.
Linked issue analysis
Closes #53 — Compliance: missing-github-actions-ecosystem. The compliance finding asked for a github-actions ecosystem entry per the standard; the new file adds exactly that with the prescribed parameters. The fix is scoped precisely to the audit finding.
Findings
No blocking or non-blocking findings.
- Config keys, values, and labels match the org GitHub Actions template verbatim.
directory: "/"is correct since workflow files live under.github/workflows/(Dependabot'sgithub-actionsecosystem scans the repo root for workflows regardless).- The PR scope is intentionally narrow; the policy doc mentions other companion files (
dependabot-automerge.yml,dependency-audit.yml,dependabot-rebase.yml) but those are out of scope for the specificmissing-github-actions-ecosystemaudit finding being closed here.
CI status
All checks green:
- ✅ CodeQL — Analyze (actions): SUCCESS
- ✅ CodeQL: SUCCESS
- ✅ CodeRabbit: SUCCESS (the visible CodeRabbit comment is a rate-limit notice on its own review service, not a failed check)
- ✅ SonarQube Cloud quality gate: passed (0 new issues, 0 hotspots)
mergeStateStatus is BLOCKED only because REVIEW_REQUIRED was outstanding; merge itself is MERGEABLE.
Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.
|
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: ef2ed489939d67a3cea3be802c7cb6f5316d81e7
Review mode: triage-approved (single reviewer)
Summary
Adds a new .github/dependabot.yml (11 lines, 1 file) with a single github-actions ecosystem entry. The configuration matches the org dependabot-policy.md GitHub Actions template verbatim — weekly schedule, open-pull-requests-limit: 10, and labels security + dependencies. No code, workflows, secrets, or runtime behavior are affected; this is config-only and confined to Dependabot's view of CI actions.
This is a triage-approved confirmation review. The prior approval at 385dde66f5d9f072ddfee3ca0bceba10acbdcf0d is still valid — the only commit added since is ef2ed48 ("ci: retrigger checks"), an empty commit that touches no files. The previous risk assessment of LOW remains correct.
Linked issue analysis
Closes #53 — Compliance: missing-github-actions-ecosystem. The audit finding asked for a github-actions ecosystem entry per the standard; the new file adds exactly that with the prescribed parameters. The fix is scoped precisely to the audit finding — no scope creep into the other companion files mentioned by the policy doc (dependabot-automerge.yml, dependency-audit.yml, dependabot-rebase.yml), which are out of scope for this specific finding.
Findings
No blocking or non-blocking findings.
- Config keys, values, and labels match the org GitHub Actions template verbatim.
directory: "/"is correct for thegithub-actionsecosystem — Dependabot scans.github/workflows/from the repo root regardless of this value.- The no-op
ci: retrigger checkscommit does not change the diff under review.
CI status
All checks green at the current SHA:
- ✅ CodeQL — Analyze (actions): SUCCESS
- ✅ CodeQL: SUCCESS
- ✅ AgentShield: SUCCESS
- ✅ Claude Code: SUCCESS
- ✅ CodeRabbit status: SUCCESS (the visible CodeRabbit comment is a rate-limit notice on its own review service, not a failed check)
- ✅ SonarCloud / SonarQube Cloud quality gate: passed (0 new issues, 0 hotspots)
- ✅ Tests (unit-tests): SUCCESS
- ✅ Dependency audit — ecosystem detection: SUCCESS
Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.
Summary
.github/dependabot.ymlwith the requiredgithub-actionsecosystem entryopen-pull-requests-limit: 10, labelssecurityanddependenciesWhy
The compliance audit flagged
missing-github-actions-ecosystem— every repository must include a Dependabot config entry forgithub-actionsto keep pinned action SHAs current and reduce CI attack surface.Closes #53
Generated with Claude Code