fix(ci): stop Dependabot desyncing the gh-aw lock files - #155
Merged
Conversation
Every gh-aw run in this repo has crashed before reaching the agent:
Error: Cannot find module '.../gh-aw/actions/merge_awf_model_multipliers.cjs'
MODULE_NOT_FOUND
The lock files are generated ("DO NOT EDIT") and their body is only valid
against the exact `github/gh-aw-actions/setup` release that produced it. Ours
had drifted apart — metadata said compiler v0.79.4 while the body had been
bumped to setup v0.83.3 — so the body invoked a helper that release no longer
ships.
Dependabot did the bumping. The ignore rule meant to prevent that never
matched: Dependabot names an action by its full path, so the dependency is
`github/gh-aw-actions/setup`, and a bare `github/gh-aw-actions` silently
matched nothing. Every commit touching these files is a Dependabot bump.
Widen the ignore to `github/gh-aw-actions*` so the rule actually applies, and
recompile all four workflows with gh aw v0.83.4 so body, manifest and pinned
action agree again.
Contributor
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
📝 WalkthroughWalkthroughThe pull request upgrades generated GitHub workflows to gh-aw v0.83.4. It updates Copilot CLI and AWF runtimes, adds daily AI-credit and OAuth handling, moves Safe Outputs to MCP stdio containers, and revises maintenance jobs and reporting. Changesgh-aw workflow upgrade
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant Activation
participant Agent
participant MCPGateway
participant Conclusion
Activation->>Agent: provide AI-credit and runtime configuration
Agent->>MCPGateway: invoke GitHub and Safe Outputs MCP services
MCPGateway-->>Agent: return tool results
Agent->>Conclusion: provide outputs and usage data
Conclusion->>Conclusion: persist credits and process Safe Outputs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/auto-triage-issues.lock.yml:
- Around line 555-558: Update the add_labels.labels schema to match
create_issue.labels by restoring its per-item type declaration, sanitization
rule, and maximum label length. Preserve the required array configuration and
use the same existing safety-policy values as create_issue.labels rather than
adding a separate policy.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 6acaa9e7-1147-4774-96e8-ed2392c46360
📒 Files selected for processing (7)
.github/aw/actions-lock.json.github/dependabot.yml.github/workflows/agentics-maintenance.yml.github/workflows/ai-auditor.lock.yml.github/workflows/auto-triage-issues.lock.yml.github/workflows/daily-secrets-analysis.lock.yml.github/workflows/duplicate-code-detector.lock.yml
Contributor
Audit Results: PASSThe audit of the changes in this pull request has been completed. No security vulnerabilities, logic bugs, or performance issues were identified. Summary of changes:
Overall, these changes improve the stability and maintainability of the CI/CD pipeline. Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
network:
allowed:
- defaults
- "localhost"See Network Configuration for more information.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Every agentic workflow in this repo has been failing — 50 runs in the last 30 days, the largest single failure cluster in the org after the runner watchdog. The agent never starts:
Root cause
*.lock.ymlfiles are generated and carry aDO NOT EDITbanner. Their body is only valid against the exactgithub/gh-aw-actions/setuprelease that produced it — that action is what materialises the.cjshelpers into$RUNNER_TEMP.Ours had split-brained:
compiler_versionin metadatav0.79.4sharecorded in the manifestd059700c…(v0.79.4)uses:6f8e8ef2…(v0.83.3)So a v0.79.4 body ran against a v0.83.3 setup action, and called a helper that release no longer ships.
Dependabot did the bumping. Every single commit touching these generated files is a Dependabot bump (#149, #146, #144, #135, #123, #114). The ignore rule intended to prevent exactly this never matched anything:
Dependabot identifies an action by its full path, so the dependency is
github/gh-aw-actions/setup. Without a wildcard the rule was a no-op.This is corroborated org-wide — the only two repos whose ignore lacks the wildcard are the only two with skewed lock files:
github/gh-aw-actionsgithub/gh-aw-actionsgithub/gh-aw-actions*Fix
github/gh-aw-actions*so it actually applies.gh aw compile(v0.83.4) so body, manifest and pinned action agree again. This matchesviz, already on v0.83.4.Verification
gh aw compile—Compiled 4 workflow(s): 0 error(s), 0 warning(s)compiler_versionnow equals the pinned setup version in all four lock files (v0.83.4)e89c65e1…now matches the body'suses:SHAmerge_awf_model_multipliers.cjsat all — that helper was a v0.79.4-era artifact, so the crash is structurally goneThe large diff is entirely regenerated output; the only hand-written change is the 1-line ignore pattern in
.github/dependabot.yml.Note
resq-software/resQhas the identical bug across 8 lock files and is being fixed in a companion PR.Summary by CodeRabbit
Maintenance
Bug Fixes