feat: add dependabot-rebase workflow standard#52
Conversation
When strict status checks require branches to be up-to-date, merging one Dependabot PR makes others fall behind. Dependabot only rebases on its weekly schedule, leaving auto-merge stalled. This workflow triggers on push to main and comments @dependabot rebase on behind PRs, preserving Dependabot's commit signature for fetch-metadata verification. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 1 minutes and 39 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThis PR introduces a new GitHub Actions workflow ( Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Pull request overview
Adds an org standard workflow template to keep Dependabot PRs rebased when branch protection requires “up-to-date” branches, and documents its required adoption across repos.
Changes:
- Add
standards/workflows/dependabot-rebase.ymlto comment@dependabot rebaseon open behind Dependabot PRs after pushes tomain. - Update
standards/dependabot-policy.mdto require the new workflow and explain why GitHub’supdate-branchAPI must not be used for Dependabot PR rebases.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| standards/workflows/dependabot-rebase.yml | New workflow template to detect behind Dependabot PRs and request Dependabot-managed rebases. |
| standards/dependabot-policy.md | Policy/doc updates adding the workflow to required config and documenting rationale/usage. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
standards/dependabot-policy.md (1)
35-42:⚠️ Potential issue | 🟠 MajorRequired-workflow policy is now out of sync with org enforcement.
This document now says every repository must include
.github/workflows/dependabot-rebase.yml, but org enforcement still uses the existing required-workflow set. Please update the org-level required-workflows standard and compliance audit list in the same rollout, otherwise this requirement is not enforceable.Based on learnings:
standards/ci-standards.mdcurrently defines exactly six universally required workflows, andscripts/compliance-audit.shenforces that same six-workflow list.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@standards/dependabot-policy.md` around lines 35 - 42, The dependabot policy was changed to require `.github/workflows/dependabot-rebase.yml` but org enforcement still enforces the previous six-workflow set; update the org-level standards and enforcement in the same rollout by adding `.github/workflows/dependabot-rebase.yml` to the universal workflow list in standards/ci-standards.md and to the hard-coded required list in scripts/compliance-audit.sh (ensure the workflow name string matches exactly and update any commentary/tests that enumerate the six workflows).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@standards/workflows/dependabot-rebase.yml`:
- Around line 26-31: The workflow can run overlapping rebase jobs on rapid
pushes; add a top-level concurrency stanza to the YAML (near the existing
on/permissions keys) to serialize runs and cancel in-progress duplicates—e.g.,
add a concurrency block with a stable group name like "dependabot-rebase-${{
github.ref }}" and set cancel-in-progress: true so only one rebase job per
branch/reference runs at a time.
---
Outside diff comments:
In `@standards/dependabot-policy.md`:
- Around line 35-42: The dependabot policy was changed to require
`.github/workflows/dependabot-rebase.yml` but org enforcement still enforces the
previous six-workflow set; update the org-level standards and enforcement in the
same rollout by adding `.github/workflows/dependabot-rebase.yml` to the
universal workflow list in standards/ci-standards.md and to the hard-coded
required list in scripts/compliance-audit.sh (ensure the workflow name string
matches exactly and update any commentary/tests that enumerate the six
workflows).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 060ca54c-8cef-4069-b0b6-02711786f591
📒 Files selected for processing (2)
standards/dependabot-policy.mdstandards/workflows/dependabot-rebase.yml
Based on testing in google-app-scripts: - @dependabot rebase only works from human users, not bots - API rebase breaks Dependabot ownership; API merge preserves it - GitHub auto-merge (--auto) fails due to BLOCKED mergeable_state - Add direct merge step and skip-commit-verification to automerge Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Summary
standards/workflows/dependabot-rebase.yml— a new workflow that triggers on push tomainand comments@dependabot rebaseon any open Dependabot PRs that have fallen behindstandards/dependabot-policy.mdto document the new workflow, explain why API rebases must not be used on Dependabot PRs, and adds the workflow to the required configuration tableProblem
When branch protection requires branches to be up-to-date (
strict: true), merging one Dependabot PR makes the others fall behindmain. Dependabot only auto-rebases on its weekly schedule or when there are merge conflicts — not when a PR merely falls behind. This leaves auto-merge stalled indefinitely.Using the GitHub API
update-branchendpoint to rebase Dependabot PRs is worse: it replaces Dependabot's commit signature, causingdependabot/fetch-metadatato reject the PR and Dependabot to refuse future rebases ("edited by someone other than Dependabot").Solution
The new workflow uses
@dependabot rebaseso Dependabot performs the rebase itself, preserving its commit signature and keeping the automerge flow intact.Test plan
google-app-scriptsfirst and validate with open Dependabot PRs🤖 Generated with Claude Code
Summary by CodeRabbit
Chores
Documentation