[GH Request] Enable orbi-bom upgrade support

[robrap]

Firm Name

2U

Urgency

Medium (< 2 weeks)

Problem/Request

Note: I didn't create this as a Github access request ticket because there were too many embedded questions.

A new 2U team orbi-bom will be taking over for arbi-bom responsibilities. However, this team does not yet have CCs.

Here are search results for arbi-bom:

• https://github.com/search?q=org%3Aopenedx+arbi-bom&type=code

1. [no action required] There are several results with arbi-bom ownership. 2U will initiate ownership transfer separately, and nothing is needed on this ticket.

owner: group:2u-arbi-bom

2. There are several dependabot.yml references as follows. Do we need an openedx/2u-orbi-bom team for this to work? Can this work if the team does not have write access on the repository? The idea would be for orbi-bom to do all the leg work for the owning teams, and the owning teams would just need to merge. Axim is one such owning team.

    reviewers:
      - "openedx/arbi-bom"

3. There are several upgrade-python-requirements.yml references as follows. We are still waiting on the orbi-bom@edx.org email to be created.

    with:
       ...
       team_reviewers: "arbi-bom"
       email_address: arbi-bom@edx.org

Unfortunately, in the workflow, I see the following:

team_reviewers:
        description: "Comma separated list of Github teams to be tagged on pull requests. NOTE: Teams must have explicit write access to the repo, or Github will refuse to tag them and the workflow will fail."

Can you think of any ideas for how orbi-bom can support these owning teams, or does this need to switch to the owning team for all of these jobs?

Reasoning

Because 2U no longer has an arbi-bom (Arbisoft) team, and now has an orbi-bom (AppHelix) team.

[github-actions]

Thank you for your report! @openedx/axim-oncall will triage within a business day. Simple requests usually take 2-3 business days to resolve; more complex requests could take longer.

[kdmccormick]

Can you think of any ideas for how orbi-bom can support these owning teams, or does this need to switch to the owning team for all of these jobs?

I will check on this. It is possible that the workflow comment is wrong and that only direct Read access is required, which we could grant to any team that needs it.

[robrap]

I will check on this. It is possible that the workflow comment is wrong and that only direct Read access is required, which we could grant to any team that needs it.

Usama had mentioned that jobs would fail without write access, but not sure if that is true for both dependabot and upgrade-python-requirements. Anyway, it wouldn't hurt to test.

[robrap]

[inform] For edx-platform, we switched the reviewer to the owning team, and updated the email notifications to orbi-bom@edx.org. See https://github.com/openedx/edx-platform/pull/37097/files.

So, we'll need to see if reviewers need write access, as suspected. If so, there is probably not much required of this ticket, except potentially helping get some of the update PRs merged.

[kdmccormick]

This recent edx-platform upgrade-python-requirements workflow successfully requested review from wg-maintenance-edx-platform, which only has Read access to edx-platform: openedx/openedx-platform#37121 . So, 2u-orbi-bom (or any team) should be able to be in the team_reviewers list as long as they have explicit Read access. Feel free to open a ticket for any team<->repo combo(s) which need explicit Read access; we can grant that liberally.

Depenadabot is not as flexible, unfortunately... seems Write access is a must:

• https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
• https://github.blog/changelog/2025-04-29-dependabot-reviewers-configuration-option-being-replaced-by-code-owners/

Currently poking around to see if there's any workaround for Dependabot.

[kdmccormick]

I hear that Renovate is the preferred tool now for keeping frontend dependencies fresh, and that the repos on Dependabot are just stragglers. Renovate's docs show a reviewer option with no mention of requiring Write access. Is there a Renovate-enabled you could test this out on @robrap ? If successful, then instead of trying to work around Dependabot, the action item could become moving repos over to Renovate.

[kdmccormick]

Aha! This Renovate PR requested 2u-phoenix for review, which only has Read access to the repo. So I think that's the path forward.