feat: Dependabot grouping, CodeQL scanning, and dependency review workflows - #137
Conversation
…rkflows, improve automerge Agent-Logs-Url: https://github.com/adamtasteslikegood/tasteslikegoodtheangularsvegancookbook/sessions/36083759-c194-4101-bf83-85a13fe170e7 Co-authored-by: adamtasteslikegood <181688233+adamtasteslikegood@users.noreply.github.com>
…cy, GITHUB_TOKEN limitation, Python scope, and Tailwind ignore Agent-Logs-Url: https://github.com/adamtasteslikegood/tasteslikegoodtheangularsvegancookbook/sessions/36083759-c194-4101-bf83-85a13fe170e7 Co-authored-by: adamtasteslikegood <181688233+adamtasteslikegood@users.noreply.github.com>
Dependency ReviewThe following issues were found:
Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. License Issues.github/workflows/dependency-review.yml
OpenSSF Scorecard
Scanned Files
|
Qodana for JS30 new problems were found
☁️ View the detailed Qodana report Contact Qodana teamContact us at qodana-support@jetbrains.com
|
There was a problem hiding this comment.
Pull request overview
This PR improves repo maintenance and security hygiene by reducing Dependabot PR noise through update grouping and adding GitHub-native security checks (dependency review + CodeQL) to the CI/CD surface.
Changes:
- Add Dependabot update grouping and standardized commit message prefixes for GitHub Actions, npm, and Docker updates.
- Add a Dependency Review workflow to block vulnerable dependency changes and deny certain licenses.
- Add a CodeQL workflow for JS/TS scanning and extend Dependabot automerge to auto-approve non-major updates.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| .github/dependabot.yml | Adds update groups (Angular/testing/linting/types/build-tools + actions) and adjusts PR limits/commit prefixes. |
| .github/workflows/codeql-analysis.yml | Adds CodeQL scanning for JavaScript/TypeScript on main pushes, PRs, and a weekly schedule. |
| .github/workflows/dependency-review.yml | Adds dependency review gating on PRs (severity threshold + license deny list + PR summary comment). |
| .github/workflows/dependabot-automerge.yml | Adds an approval step for non-major Dependabot PRs before enabling auto-merge. |
| gh pr review "$PR_URL" --approve --body "Auto-approved: Dependabot ${{ steps.metadata.outputs.update-type }} update." | ||
| env: | ||
| PR_URL: ${{ github.event.pull_request.html_url }} |
There was a problem hiding this comment.
The auto-approve step is not idempotent: this workflow runs on synchronize and reopened, and gh pr review --approve will fail if the token/user has already submitted an approving review on the PR. That failure would prevent the subsequent auto-merge enable step from running. Consider making this step tolerant (e.g., detect an existing approval from the bot before approving, or allow the command to succeed when already approved).
| gh pr review "$PR_URL" --approve --body "Auto-approved: Dependabot ${{ steps.metadata.outputs.update-type }} update." | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| set -euo pipefail | |
| # Determine the login for the current token (bot/user running this workflow) | |
| REVIEWER_LOGIN="$(gh api user --jq .login)" | |
| echo "Reviewer login for this token: ${REVIEWER_LOGIN}" | |
| # Check if this reviewer already has an APPROVED review on the PR | |
| existing_review_id="$( | |
| gh api \ | |
| "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/reviews" \ | |
| --paginate \ | |
| --jq ".[] | select(.user.login == \"${REVIEWER_LOGIN}\" and .state == \"APPROVED\") | .id" \ | |
| | head -n 1 || true | |
| )" | |
| if [ -n "${existing_review_id}" ]; then | |
| echo "An existing APPROVED review from ${REVIEWER_LOGIN} already exists (review id: ${existing_review_id}); skipping new approval." | |
| else | |
| echo "No existing APPROVED review from ${REVIEWER_LOGIN}; submitting approval." | |
| gh pr review "$PR_URL" --approve --body "Auto-approved: Dependabot ${{ steps.metadata.outputs.update-type }} update." | |
| fi | |
| env: | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} |
| # Deny copyleft licenses incompatible with the project's proprietary distribution | ||
| deny-licenses: GPL-2.0-only, GPL-3.0-only, AGPL-3.0-only |
There was a problem hiding this comment.
The PR description says the dependency review workflow “Blocks GPL/AGPL copyleft licenses”, but the deny-licenses list only includes the *-only SPDX identifiers. Licenses like GPL-3.0-or-later / AGPL-3.0-or-later would still be allowed. If the intent is to block all GPL/AGPL variants, include the corresponding *-or-later IDs (and any other copyleft licenses you intend to deny).
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 762dac832a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if: steps.metadata.outputs.update-type != 'version-update:semver-major' | ||
| run: | | ||
| gh pr review "$PR_URL" --approve --body "Auto-approved: Dependabot ${{ steps.metadata.outputs.update-type }} update." |
There was a problem hiding this comment.
This new approval step can fail in common repo configurations (for example when the repository setting that allows GitHub Actions to approve PRs is not enabled), and when it fails the job stops before Enable auto-merge (squash) runs. That turns patch/minor Dependabot updates into manual merges, which is a regression from the previous workflow behavior that at least attempted auto-merge. Please guard this command or make approval failure non-fatal so auto-merge still gets enabled when possible.
Useful? React with 👍 / 👎.
Description
20 open Dependabot PRs were piling up because no grouping was configured — each dependency got its own PR (e.g., 8 separate PRs for
@angular/*). Additionally, the CI pipeline lacked security scanning beyond Qodana's code quality checks.Dependabot optimization (
.github/dependabot.yml)angular,testing,linting,types,build-tools— collapses ~20 PRs into ~6@tailwindcss/postcssmigration, breakspostcss.config.js)ci,build(deps),build(docker)New: CodeQL security scanning (
.github/workflows/codeql-analysis.yml)security-extendedquery suite; results in repo Security tabNew: Dependency review (
.github/workflows/dependency-review.yml)Improved automerge (
.github/workflows/dependabot-automerge.yml)GITHUB_TOKENlimitation vs. branch protection requiring specific reviewersType of Change
Testing
No application code changed — all changes are GitHub Actions workflow YAML and Dependabot configuration. Validated with
yaml.safe_load()across all 4 files.npm run test)npm run lint)npm run format)npm run build)npm run type-check)Checklist
Screenshots (if applicable)
N/A — CI/CD config changes only.
Additional Notes
After merge, Dependabot will close existing ungrouped PRs and re-open grouped replacements on its next scheduled run (weekly). The 20 open Dependabot PRs should consolidate down to ~6-7.
📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.