Repository navigation
ci: add CodeQL, Dependabot auto-merge, and PR branch updates - #7
Conversation
Enable advanced CodeQL with concurrency, auto-merge non-major Dependabot PRs, and keep outdated PR branches current with main.
📝 WalkthroughWalkthroughThe pull request adds three GitHub Actions workflows. They run CodeQL analysis, merge eligible Dependabot pull requests, and update outdated pull request branches. ChangesRepository automation
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
🧹 Nitpick comments (2)
.github/workflows/dependabot-auto-merge.yml (1)
25-25: 🩺 Stability & Availability | 🔵 TrivialVerify the squash strategy against CodeQL.
Line 25 selects
--squash, and this PR also adds advanced CodeQL. If theon.pushblock in.github/workflows/codeql.ymluploads results onmain, a squash merge creates a Dependabot-authored commit. GitHub documents that workflows on this commit receive read-only permissions, which can make the CodeQL upload fail. Verify the CodeQL trigger. Use--mergefor this path or keep the upload on apull_requestrun. (docs.github.com)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/dependabot-auto-merge.yml at line 25, Verify the CodeQL workflow’s on.push trigger and its upload behavior on main. If results are uploaded from push-triggered runs, update the Dependabot merge command in the auto-merge workflow from squash to merge; otherwise preserve the squash strategy only when CodeQL uploads through a pull_request run..github/workflows/update-outdated-prs.yml (1)
3-8: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winSerialize scans of outdated pull requests.
This workflow has
push,schedule, andworkflow_dispatchtriggers, but it has noconcurrencygroup. GitHub Actions allows multiple workflow runs to execute concurrently by default. (docs.github.com) Two runs can process the sameBEHINDpull request and issue duplicate updates or comments.Add a workflow-level group with
cancel-in-progress: false.Proposed fix
on: push: branches: [main] schedule: - cron: '0 */6 * * *' workflow_dispatch: +concurrency: + group: ${{ github.workflow }} + cancel-in-progress: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/update-outdated-prs.yml around lines 3 - 8, Add a workflow-level concurrency configuration to the update-outdated-PRs workflow, using a shared group for all triggers and setting cancel-in-progress to false so scans run serially without canceling an active run.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/codeql.yml:
- Around line 35-36: Update the actions/checkout step in the CodeQL workflow to
set persist-credentials to false, while preserving the existing checkout action
and version.
- Around line 35-36: Update the actions/checkout step in the workflow from v4 to
the Node24-compatible major version, while preserving the existing repository
checkout behavior and configuration.
In @.github/workflows/dependabot-auto-merge.yml:
- Around line 16-18: Update the dependabot/fetch-metadata action reference in
the workflow to use a full-length immutable commit SHA instead of the mutable
`@v2` tag. Preserve the action’s current version through an adjacent documentation
comment if needed, while leaving the existing github-token configuration
unchanged.
- Around line 20-24: Update the auto-merge guard for “Enable auto-merge for
non-major updates” to restrict eligibility to the configured bun and cargo
ecosystems or their corresponding dependency groups. Preserve the existing
exclusions for bun-major, cargo-major, and semver-major updates, and ensure
github-actions updates cannot reach the squash auto-merge step.
In @.github/workflows/update-outdated-prs.yml:
- Line 22: Update the workflow’s Dependabot PR processing loop to guard each gh
pr comment failure so one API error does not terminate the loop or skip later
pull requests. For non-Dependabot PRs, handle gh pr update-branch failures by
distinguishing actual merge conflicts from authentication, rate-limit, and other
API errors, and fail or report those errors rather than treating every failure
as a conflict.
- Around line 29-35: Update the author pattern in the case statement to match
the literal Dependabot login by escaping or quoting its square brackets.
Preserve the existing app/dependabot alternative and the rebase comment behavior
for both Dependabot identities.
- Around line 24-27: Update the gh pr list invocation in the outdated-PR
processing pipeline to explicitly retrieve all relevant open pull requests
beyond the default 30-result limit, using an appropriate --limit value or
equivalent pagination. Preserve the existing filters and the number/author
output consumed by the while loop.
---
Nitpick comments:
In @.github/workflows/dependabot-auto-merge.yml:
- Line 25: Verify the CodeQL workflow’s on.push trigger and its upload behavior
on main. If results are uploaded from push-triggered runs, update the Dependabot
merge command in the auto-merge workflow from squash to merge; otherwise
preserve the squash strategy only when CodeQL uploads through a pull_request
run.
In @.github/workflows/update-outdated-prs.yml:
- Around line 3-8: Add a workflow-level concurrency configuration to the
update-outdated-PRs workflow, using a shared group for all triggers and setting
cancel-in-progress to false so scans run serially without canceling an active
run.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 0232e02d-6847-490f-ad97-044e51a39792
📒 Files selected for processing (3)
.github/workflows/codeql.yml.github/workflows/dependabot-auto-merge.yml.github/workflows/update-outdated-prs.yml
| - name: Checkout repository | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
workflow=".github/workflows/codeql.yml"
rg -n -A5 'uses:[[:space:]]*actions/checkout@' "$workflow" |
rg -q 'persist-credentials:[[:space:]]*false'Repository: geoffsee/vtt-rs
Length of output: 153
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow outline =="
wc -l .github/workflows/codeql.yml
cat -n .github/workflows/codeql.yml
echo
echo "== checkout occurrences with context =="
rg -n -C3 'uses:[[:space:]]*actions/checkout@|git |actions/upload|persist-credentials|permissions:' .github/workflows/codeql.yml
echo
echo "== all workflow git/artifact/auth-related tokens =="
rg -n 'git|upload|archive|GITHUB_TOKEN|GITHUB_API_URL|permissions:|pull_request_target|pull_request|push:' .github/workflows -g '*.yml' -g '*.yaml'Repository: geoffsee/vtt-rs
Length of output: 5117
🌐 Web query:
actions/checkout v4 action.yml persist-credentials default git config credentialStore
💡 Result:
In the actions/checkout v4 action, the persist-credentials input has a default value of true [1][2][3]. When persist-credentials is set to true, the action configures the authentication token or SSH key used for the checkout into the local git configuration of the repository [1][2]. This allows subsequent steps in your workflow to run authenticated git commands (such as git push) without needing to manually configure credentials [2][4]. The token is removed from the local git configuration during the post-job cleanup process [2][4]. To prevent these credentials from being stored in the local git config, you can explicitly set the input to false in your workflow: - uses: actions/checkout@v4 with: persist-credentials: false While the default is true, it is worth noting that this behavior has been a subject of security discussion regarding the potential for subsequent steps in a workflow to access the persisted token [5][6]. For enhanced security, especially if your workflow involves untrusted code, it is recommended to use specific permissions for the GITHUB_TOKEN or set persist-credentials to false [6].
Citations:
- 1: https://github.com/actions/checkout/blob/v4/action.yml
- 2: https://github.com/actions/checkout/blob/v4/README.md
- 3: https://github.com/actions/checkout/blob/v4.1.1/action.yml
- 4: https://github.com/actions/checkout/blob/main/README.md
- 5: [security] Escalate concerning default
persist-credentials=trueplease actions/checkout#2312 - 6: Remove
persist-credentialsor change the default tofalseactions/checkout#485
Disable checkout credential persistence.
This CodeQL workflow only needs the contents read permission for checkout. actions/checkout persists the token by default, so later steps or future changes can access credentials unnecessarily. Set persist-credentials: false when checking out the repository.
Proposed fix
- name: Checkout repository
- uses: actions/checkout@v4
+ uses: actions/checkout@v4
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 35-36: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml around lines 35 - 36, Update the
actions/checkout step in the CodeQL workflow to set persist-credentials to
false, while preserving the existing checkout action and version.
Source: Linters/SAST tools
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
workflow=".github/workflows/codeql.yml"
rg -q '^[[:space:]]*uses:[[:space:]]*actions/checkout@v(5|6|7)([[:space:]]|$)' "$workflow"Repository: geoffsee/vtt-rs
Length of output: 153
🌐 Web query:
actions checkout v4 action.yml runs.using node20
💡 Result:
The actions/checkout v4 action uses node20 as its runtime environment [1][2]. This is specified in its action.yml file under the runs.using key [1]. The update to node20 was a primary feature of the v4.0.0 release [3][4], which replaced the previous node16 runtime [5]. This change requires a minimum Actions Runner version of v2.308.0 [6][7].
Citations:
- 1: https://github.com/actions/checkout/blob/v4/action.yml
- 2: https://github.com/actions/checkout/blob/72f2cec99f417b1a1c5e2e88945068983b7965f9/action.yml
- 3: https://github.com/actions/checkout/blob/v4/CHANGELOG.md
- 4: https://github.com/actions/checkout/releases/tag/v4.0.0
- 5: Update default runtime to node20 actions/checkout#1436
- 6: https://github.com/actions/checkout/tree/8ade135a41bc03ea155e62e844d188df1ea18608
- 7: https://git.lightless-sync.org/actions/checkout/raw/tag/v4.0.0/README.md
🌐 Web query:
actions checkout v7 action.yml runs.using node24
💡 Result:
The actions/checkout v7 release uses node24 for its execution runtime [1]. This update was implemented to align with the deprecation of Node 20 on GitHub Actions runners [2][3]. In the action.yml file for versions v7 and later, the runs configuration is defined as: runs: using: node24 main: dist/index.js post: dist/index.js Support for node24 was introduced to the GitHub Actions runner in version 2.327.1 [4]. Many other GitHub Actions have similarly migrated their runtime from node20 to node24 as part of the broader transition away from Node 20 [2][5][3][6].
Citations:
- 1: actions/checkout@v4.2.2...v7.0.0
- 2: chore: run Action on Node 24 per GitHub Node 20 deprecation github/command#99
- 3: dorny/test-reporter@ad0a96f
- 4: Update actions checkout to use node 24 actions/checkout#2226
- 5: actions/dependency-review-action@bb69b99
- 6: feat!: upgrade GitHub Actions runtime from node20 to node24 joshjohanning/ensure-immutable-actions#46
Upgrade actions/checkout to a Node24-compatible major.
actions/checkout@v4 uses runs.using: node20. Use a major version that has Node24 support to avoid runner runtime deprecation on GitHub-hosted workflows.
Proposed fix
- name: Checkout repository
- uses: actions/checkout@v4
+ uses: actions/checkout@v7🧰 Tools
🪛 zizmor (1.28.0)
[warning] 35-36: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql.yml around lines 35 - 36, Update the
actions/checkout step in the workflow from v4 to the Node24-compatible major
version, while preserving the existing repository checkout behavior and
configuration.
| uses: dependabot/fetch-metadata@v2 | ||
| with: | ||
| github-token: ${{ secrets.GITHUB_TOKEN }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow file =="
cat -n .github/workflows/dependabot-auto-merge.yml
echo
echo "== relevant action uses in workflows =="
rg -n "uses:\s*dependabot/fetch-metadata|permissions:|GITHUB_TOKEN|permissions:" .github/workflows || true
echo
echo "== diff stat/name status =="
git diff --stat HEAD~1..HEAD || true
git diff -- .github/workflows/dependabot-auto-merge.yml || trueRepository: geoffsee/vtt-rs
Length of output: 2469
🌐 Web query:
dependabot fetch-metadata GitHub Actions v2 immutable commit SHA security GitHub Actions Security
💡 Result:
To ensure supply chain security when using GitHub Actions like dependabot/fetch-metadata, it is a industry best practice to pin actions to their full 40-character commit SHA rather than a mutable tag (e.g., v2 or v3) [1][2][3]. Pinning to an immutable commit SHA prevents unauthorized or malicious changes to the action's code from executing in your environment if the upstream tag or branch is compromised [4][3]. Because commit hashes are immutable, the workflow will consistently run only the exact code you have reviewed [5][6]. To maintain the ability to easily update to newer versions while keeping the security benefit of pinning: 1. Use the full 40-character commit SHA in your workflow configuration [2][3]. 2. Include the human-readable version as a trailing comment (e.g., uses: dependabot/fetch-metadata@d7267f6 # v3.0.0) [4][3]. 3. Dependabot and other automated tools are designed to recognize this pattern; they will still identify when a new version is released and open a pull request to update both the SHA and the version comment, allowing you to review updates as they occur [4][3][6]. GitHub now supports organizational-level policies that can enforce this requirement, causing workflows to fail if they attempt to use unpinned actions, which underscores the importance of this practice for modern, secure CI/CD pipelines [7][6].
Citations:
- 1: fix: pin dependabot/fetch-metadata action to immutable SHA OpenCoven/coven#280
- 2: https://docs.github.com/en/actions/reference/security/secure-use
- 3: https://starsling.dev/best-practices/github-actions/pin-action-shas
- 4: https://tomodahinata.com/en/blog/dependabot-github-actions-sha-pinning-supply-chain-security-guide
- 5: https://microsoft.github.io/zerotrustassessment/docs/workshop-guidance/devsecops/DS_032
- 6: https://www.romainlespinasse.dev/posts/github-actions-commit-sha-pinning/
- 7: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/
Pin the metadata action to an immutable commit.
.github/workflows/dependabot-auto-merge.yml:16 uses mutable dependabot/fetch-metadata@v2 while the workflow grants contents: write and pull-requests: write. Replace @v2 with an immutable full-length commit SHA from dependabot/fetch-metadata, and keep the version as a documentation comment if needed.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/dependabot-auto-merge.yml around lines 16 - 18, Update the
dependabot/fetch-metadata action reference in the workflow to use a full-length
immutable commit SHA instead of the mutable `@v2` tag. Preserve the action’s
current version through an adjacent documentation comment if needed, while
leaving the existing github-token configuration unchanged.
| - name: Enable auto-merge for non-major updates | ||
| if: > | ||
| steps.metadata.outputs.dependency-group != 'bun-major' && | ||
| steps.metadata.outputs.dependency-group != 'cargo-major' && | ||
| steps.metadata.outputs.update-type != 'version-update:semver-major' |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow files =="
git ls-files .github/workflows || true
echo
echo "== target workflow =="
if [ -f .github/workflows/dependabot-auto-merge.yml ]; then
cat -n .github/workflows/dependabot-auto-merge.yml
fi
echo
echo "== search for dependabot fetch-metadata and package-ecosystem usage =="
rg -n "dependabot/fetch-metadata|package-ecosystem|dependency-group|update-type|allow|merge" .github -S || true
echo
echo "== repo files mentioning dependabot/config =="
git ls-files | rg '(^|/)dependabot|dependabot\.ya' || trueRepository: geoffsee/vtt-rs
Length of output: 3181
🌐 Web query:
dependabot/fetch-metadata v2 package-ecosystem README
💡 Result:
The dependabot/fetch-metadata GitHub Action provides metadata about dependencies being updated in a Dependabot-generated pull request [1][2][3]. The package-ecosystem output is one of the key pieces of information exposed by this action [1][4]. Specifically, the output steps.dependabot-metadata.outputs.package-ecosystem returns the package ecosystem configuration (e.g., npm, pip, bundler) used by Dependabot for the dependency being updated [1][2]. This output was introduced to the action to allow workflows to programmatically identify the ecosystem of the updated package, enabling more specific automation logic based on the package manager [4]. While the action has evolved through several versions (e.g., v1, v2, v3) [5][3], the package-ecosystem output has remained a standard feature for capturing the relevant configuration context from Dependabot [1][3]. In a typical workflow usage, you would reference this output in subsequent steps after the fetch-metadata action step [1][6].
Citations:
- 1: https://github.com/dependabot/fetch-metadata/blob/main/README.md
- 2: https://github.com/dependabot/fetch-metadata?tab=readme-ov-file
- 3: https://github.com/marketplace/actions/fetch-metadata-from-dependabot-prs
- 4: Added directory, package-ecosystem and target_branch to output dependabot/fetch-metadata#139
- 5: dependabot/fetch-metadata@v1...v2
- 6: https://docs.github.com/en/code-security/tutorials/secure-your-dependencies/automate-dependabot-with-actions
Restrict auto-merge to the configured ecosystems.
This workflow runs for Dependabot PRs but .github/dependabot.yml also configures github-actions; a non-major github-actions update can pass this condition and trigger squash auto-merge. Include package-ecosystem in the guard, or target only the intended bun/cargo groups.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/dependabot-auto-merge.yml around lines 20 - 24, Update the
auto-merge guard for “Enable auto-merge for non-major updates” to restrict
eligibility to the configured bun and cargo ecosystems or their corresponding
dependency groups. Preserve the existing exclusions for bun-major, cargo-major,
and semver-major updates, and ensure github-actions updates cannot reach the
squash auto-merge step.
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| run: | | ||
| set -euo pipefail |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '1\tdependabot[bot]\n2\tuser\n' |
while IFS=$'\t' read -r number author; do
[[ "$number" != 1 ]]
echo "processed PR #$number"
doneRepository: geoffsee/vtt-rs
Length of output: 153
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "Workflow excerpt:"
sed -n '1,80p' .github/workflows/update-outdated-prs.yml
echo
echo "Shell loop semantics for pipeline errors:"
bash -c 'set -euo pipefail; printf "1\n2\n" | while IFS="$\t" read -r number; do
[[ "$number" != 1 ]] || false
echo "processed PR #$number"
done'
echo "status=$?"Repository: geoffsee/vtt-rs
Length of output: 1518
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "Workflow excerpt:"
sed -n '1,90p' .github/workflows/update-outdated-prs.yml
echo
echo "Pipeline failure behavior in the current loop style:"
bash -c 'set -euo pipefail; printf "1\tdependabot[bot]\n2\tregular-user\n" | while IFS=$'\''\t'\'' read -r number author; do
if [[ "$author" == "dependabot[bot]" && "$number" != "1" ]]; then
true
else
false
fi
echo "processed PR #$number by $author"
done'
status=$?
echo "status=$status"Repository: geoffsee/vtt-rs
Length of output: 1529
Handle gh API failures per pull request.
set -euo pipefail with set -e exits the piped row loop on an unguarded failed command in Dependabot PR processing. Catch gh pr comment errors per PR to avoid skipping later PRs. For non-Dependabot PRs, avoid treating every failed gh pr update-branch as a conflict, because authentication, rate-limit, and other API errors can make the workflow report success while the branch remains stale.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/update-outdated-prs.yml at line 22, Update the workflow’s
Dependabot PR processing loop to guard each gh pr comment failure so one API
error does not terminate the loop or skip later pull requests. For
non-Dependabot PRs, handle gh pr update-branch failures by distinguishing actual
merge conflicts from authentication, rate-limit, and other API errors, and fail
or report those errors rather than treating every failure as a conflict.
| gh pr list --repo "$GITHUB_REPOSITORY" --base main --state open \ | ||
| --json number,author,isDraft,mergeStateStatus \ | ||
| --jq '.[] | select(.isDraft|not) | select(.mergeStateStatus == "BEHIND") | "\(.number)\t\(.author.login)"' \ | ||
| | while IFS=$'\t' read -r number author; do |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
gh pr list --help | grep -E -- '--limit.*default 30'Repository: geoffsee/vtt-rs
Length of output: 225
🌐 Web query:
GitHub CLI gh pr list default limit 30 documentation
💡 Result:
In the GitHub CLI, the gh pr list command has a default limit of 30 items [1][2][3][4]. You can modify this limit by using the --limit (or -L) flag followed by your desired integer value [1][2][5][6]. For example, running gh pr list --limit 100 will fetch up to 100 pull requests [5][6].
Citations:
- 1: https://cli.github.com/manual/gh_pr_list
- 2: https://cli.github.com/manual/gh_help_reference
- 3: https://man.archlinux.org/man/gh-pr-list.1.en
- 4: https://manpages.debian.org/trixie/gh/gh-pr-list.1.en.html
- 5: https://github.com/cli/cli/blob/c14cbaa2/skills/gh/SKILL.md
- 6: https://github.com/github/gh-cli/blob/v2.94.0/skills/gh/SKILL.md
Paginate the pull request list.
gh pr list defaults to a limit of 30, so repositories with more than 30 matching pull requests can leave some outdated branches unprocessed. Set an explicit --limit or paginate until all results are consumed.
Proposed fix
gh pr list --repo "$GITHUB_REPOSITORY" --base main --state open \
+ --limit 1000 \
--json number,author,isDraft,mergeStateStatus \📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| gh pr list --repo "$GITHUB_REPOSITORY" --base main --state open \ | |
| --json number,author,isDraft,mergeStateStatus \ | |
| --jq '.[] | select(.isDraft|not) | select(.mergeStateStatus == "BEHIND") | "\(.number)\t\(.author.login)"' \ | |
| | while IFS=$'\t' read -r number author; do | |
| gh pr list --repo "$GITHUB_REPOSITORY" --base main --state open \ | |
| --limit 1000 \ | |
| --json number,author,isDraft,mergeStateStatus \ | |
| --jq '.[] | select(.isDraft|not) | select(.mergeStateStatus == "BEHIND") | "\(.number)\t\(.author.login)"' \ | |
| | while IFS=$'\t' read -r number author; do |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/update-outdated-prs.yml around lines 24 - 27, Update the
gh pr list invocation in the outdated-PR processing pipeline to explicitly
retrieve all relevant open pull requests beyond the default 30-result limit,
using an appropriate --limit value or equivalent pagination. Preserve the
existing filters and the number/author output consumed by the while loop.
| case "$author" in | ||
| dependabot[bot]|app/dependabot) | ||
| # Dependabot rebase retriggers checks; GITHUB_TOKEN branch updates do not. | ||
| gh pr comment "$number" --repo "$GITHUB_REPOSITORY" --body "@dependabot rebase" | ||
| ;; | ||
| *) | ||
| gh pr update-branch "$number" --repo "$GITHUB_REPOSITORY" || { |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
author='dependabot[bot]'
case "$author" in
dependabot[bot]|app/dependabot) echo "matched" ;;
*) echo "default branch" ;;
esacRepository: geoffsee/vtt-rs
Length of output: 168
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "== workflow files =="
git ls-files '.github/workflows/*' | sort
echo
echo "== update-outdated-prs relevant excerpt =="
if [ -f .github/workflows/update-outdated-prs.yml ]; then
nl -ba .github/workflows/update-outdated-prs.yml | sed -n '1,80p'
fi
echo
echo "== dependabot auth extraction references =="
rg -n 'author|dependabot\[bot\]|GITHUB_ACTOR|dependabot-auto-merge|update-branch|pr comment' .github/workflows || trueRepository: geoffsee/vtt-rs
Length of output: 520
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "== update-outdated-prs relevant excerpt =="
if [ -f .github/workflows/update-outdated-prs.yml ]; then
awk '{printf "%5d\t%s\n", NR, $0}' .github/workflows/update-outdated-prs.yml | sed -n '1,100p'
fi
echo
echo "== dependabot auth extraction references =="
rg -n 'author|dependabot\[bot\]|GITHUB_ACTOR|dependabot-auto-merge|update-branch|pr comment|gh pr' .github/workflows || trueRepository: geoffsee/vtt-rs
Length of output: 3026
Escape the brackets in the Dependabot pattern.
Bash treats dependabot[bot] as a bracket-expression pattern, so it matches usernames like dependabotbot instead of the literal login dependabot[bot]. Dependabot open PRs then use the * branch and run gh pr update-branch instead of posting @dependabot rebase.
Proposed fix
case "$author" in
- dependabot[bot]|app/dependabot)
+ dependabot\[bot\]|app/dependabot)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| case "$author" in | |
| dependabot[bot]|app/dependabot) | |
| # Dependabot rebase retriggers checks; GITHUB_TOKEN branch updates do not. | |
| gh pr comment "$number" --repo "$GITHUB_REPOSITORY" --body "@dependabot rebase" | |
| ;; | |
| *) | |
| gh pr update-branch "$number" --repo "$GITHUB_REPOSITORY" || { | |
| case "$author" in | |
| dependabot\[bot\]|app/dependabot) | |
| # Dependabot rebase retriggers checks; GITHUB_TOKEN branch updates do not. | |
| gh pr comment "$number" --repo "$GITHUB_REPOSITORY" --body "`@dependabot` rebase" | |
| ;; | |
| *) | |
| gh pr update-branch "$number" --repo "$GITHUB_REPOSITORY" || { |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/update-outdated-prs.yml around lines 29 - 35, Update the
author pattern in the case statement to match the literal Dependabot login by
escaping or quoting its square brackets. Preserve the existing app/dependabot
alternative and the rebase comment behavior for both Dependabot identities.
1 participant
Summary
actions rust) with concurrency cancel-in-progressbun-major/cargo-major/ semver-major skipped)mainpush, schedule, and workflow_dispatchNotes
allow_auto_mergeenabledTest plan
gh workflow run update-outdated-prs.ymlworksSummary by CodeRabbit