feat(ci): add guarded Mergify auto-merge for Dependabot security PRs#563
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
📜 Recent review details⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
📝 WalkthroughSummary by CodeRabbit
WalkthroughAdds a workflow that detects security-related Dependabot PRs and toggles a ChangesSecurity Update Automation
Sequence DiagramsequenceDiagram
participant Dependabot
participant GitHubActions as GitHub Actions Workflow
participant LabelAPI as GitHub API (Labels)
participant Mergify
Dependabot->>GitHubActions: Create/edit PR to develop
GitHubActions->>LabelAPI: Ensure `meta:dependabot-security` exists
GitHubActions->>GitHubActions: Scan PR title/body for security patterns
alt Security pattern detected
GitHubActions->>LabelAPI: Add `meta:dependabot-security`
else No security pattern
GitHubActions->>LabelAPI: Remove `meta:dependabot-security` if present
end
LabelAPI-->>Mergify: Label state updated
alt PR has `dependencies` + `meta:dependabot-security` and checks pass
Mergify->>Mergify: Merge PR (squash) to develop
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
coderabbitai
Bot
added
priority:normal
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 19df9a52aa
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request configures Mergify to auto-merge Dependabot security updates on the develop branch, introducing a new 'dependabot:security' label and removing the old 'security' label from dependabot.yml. Feedback on the changes highlights a critical issue where the Mergify configuration lacks status check requirements, meaning updates could be merged automatically even if CI checks fail. It is recommended to add explicit check-success conditions to the Mergify rules.
ashleyshaw
removed
the
meta:needs-changelog
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/dependabot-security-label.yml (1)
18-18: ⚡ Quick winConsider SHA-pinning the action for enhanced supply-chain security.
Whilst tag-based pinning (v7) is acceptable per the coding guidelines, SHA-pinning offers stronger immutability guarantees. Static analysis flagged this as well.
🔐 Proposed fix to use SHA-pinned action
You can find the SHA for
actions/github-script@v7and pin it like so:- - uses: actions/github-script@v7 + - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1Check the releases page for the exact SHA of the version you want.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/dependabot-security-label.yml at line 18, Replace the tag-based reference "actions/github-script@v7" with a SHA-pinned reference for the exact v7 release (e.g., "actions/github-script@<sha>"); locate the step that uses the string actions/github-script@v7 in the workflow and update it to the corresponding commit SHA from the actions/github-script release you want to lock to, ensuring the action is immutably pinned for supply-chain security..github/mergify.yml (1)
1-13: ⚖️ Poor tradeoffOptionally require code review approvals for an extra safety layer.
Whilst auto-merging security updates is convenient, requiring at least one human approval can catch cases where the security pattern detection yields false positives or where the update might have unexpected impacts.
🛡️ Example: add approval requirement
pull_request_rules: - name: Auto-merge Dependabot security updates on develop conditions: - author=dependabot[bot] - base=develop - label=dependencies - label=dependabot:security - -draft - -conflict + - "`#approved-reviews-by`>=1" actions: merge: method: squash strict: smart🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/mergify.yml around lines 1 - 13, Add a requirement for at least one human approval to the existing auto-merge rule by adding a review approval condition to the pull_request_rules entry named "Auto-merge Dependabot security updates on develop" (the block containing conditions and actions.merge.method). Insert a condition like "review-approved" or "approved-reviews-by>=1" into the conditions list so the rule only auto-merges when the PR has at least one approved review, keeping the existing author/base/label/draft/conflict checks and merge.method strictness.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/dependabot-security-label.yml:
- Around line 8-10: Move the top-level permissions block into the specific job
that runs Dependabot labels: remove the workflow-level "permissions:" entry
(contents: read, pull-requests: write) and add an equivalent "permissions:"
section under the appropriate job definition in the "jobs" map, scoping
pull-requests: write only to that job and keeping other permissions read-only;
ensure the job-level block uses the same keys ("contents" and "pull-requests")
and that no other workflows rely on the removed global permissions.
---
Nitpick comments:
In @.github/mergify.yml:
- Around line 1-13: Add a requirement for at least one human approval to the
existing auto-merge rule by adding a review approval condition to the
pull_request_rules entry named "Auto-merge Dependabot security updates on
develop" (the block containing conditions and actions.merge.method). Insert a
condition like "review-approved" or "approved-reviews-by>=1" into the conditions
list so the rule only auto-merges when the PR has at least one approved review,
keeping the existing author/base/label/draft/conflict checks and merge.method
strictness.
In @.github/workflows/dependabot-security-label.yml:
- Line 18: Replace the tag-based reference "actions/github-script@v7" with a
SHA-pinned reference for the exact v7 release (e.g.,
"actions/github-script@<sha>"); locate the step that uses the string
actions/github-script@v7 in the workflow and update it to the corresponding
commit SHA from the actions/github-script release you want to lock to, ensuring
the action is immutably pinned for supply-chain security.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 7679b704-df0a-497d-92ef-d513451d8c97
📒 Files selected for processing (4)
.github/dependabot.yml.github/labels.yml.github/mergify.yml.github/workflows/dependabot-security-label.yml
💤 Files with no reviewable changes (1)
- .github/dependabot.yml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (6)
- GitHub Check: add-and-sync
- GitHub Check: validate
- GitHub Check: Unified Labeling, Status, and Type Assignment
- GitHub Check: readme-regen
- GitHub Check: coderabbit-gate
- GitHub Check: check
🧰 Additional context used
📓 Path-based instructions (1)
**/.github/workflows/*.yml
⚙️ CodeRabbit configuration file
**/.github/workflows/*.yml: Review GitHub Actions workflows for this governance repo:
- Security: check for least-privilege permissions (use
permissions:at job level, default to read-only).- Secret handling: ensure secrets are passed via env vars, not interpolated directly into run: steps to prevent injection.
- Action pinning: prefer SHA-pinned actions over mutable tags (e.g.
actions/checkout@v4is acceptable; SHA pins are better).- No
pull_request_targetwith untrusted code execution unless explicitly justified.- Avoid storing sensitive outputs as unmasked step outputs.
- Check for reusable workflow patterns and matrix strategies where appropriate.
- Validate
on:triggers: ensure branch/path filters are present to avoid unnecessary runs.- Confirm workflows are documented, DRY, and maintainable.
- Ensure agent-triggered workflows use
workflow_dispatchwith defined inputs.
Files:
.github/workflows/dependabot-security-label.yml
🪛 zizmor (1.25.2)
.github/workflows/dependabot-security-label.yml
[error] 18-18: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🔇 Additional comments (4)
.github/labels.yml (1)
413-415: LGTM!.github/workflows/dependabot-security-label.yml (2)
13-15: LGTM!
21-75: LGTM!.github/mergify.yml (1)
1-13: 🏗️ Heavy liftEnsure Dependabot auto-merge on
developis gated by successful CI checks.The Mergify rule in
.github/mergify.ymlrestricts author/base/labels (and excludes draft/conflicts) but contains nocheck-success/status-successconditions—so it currently looks like there’s no “CI bouncer”. Mergify may still honour whatever “required status checks” are configured indevelopbranch protection, so confirm thatdevelopactually requires the relevant CI contexts; if it doesn’t, add explicitcheck-success = <check-name>conditions (or qualifiedcheck-success = @<app-name>/<check-name>).
🔍 Reviewer Summary for PR #563CI Status: ✅ Recommendations
|
🔍 Reviewer Summary for PR #563CI Status: ✅ Recommendations
|
|
Addressed requested fixes:\n\n1. Moved permissions to job scope and added issues:write for label mutations in dependabot-security-label workflow.\n2. Added explicit check-success conditions in Mergify before auto-merge.\n\nResolved the related review threads; please re-evaluate merge readiness. |
github-actions
Bot
added
area:ci
coderabbitai
Bot
added
the
meta:needs-changelog
There was a problem hiding this comment.
🧹 Nitpick comments (2)
.github/workflows/dependabot-security-label.yml (2)
18-18: ⚡ Quick winConsider SHA-pinning the action for stronger supply-chain security.
Whilst
@v7is acceptable, pinning to a specific SHA provides better protection against tag-moving attacks and unexpected upstream changes. As per coding guidelines, "prefer SHA-pinned actions over mutable tags".🔒 Example SHA-pin format
- - name: Detect security-related Dependabot updates - uses: actions/github-script@v7 + - name: Detect security-related Dependabot updates + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1(Find the current v7 SHA at https://github.com/actions/github-script/releases)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/dependabot-security-label.yml at line 18, Replace the mutable tag usage of the GitHub Action by pinning actions/github-script@v7 to a specific commit SHA: locate the line using "uses: actions/github-script@v7" and update it to the corresponding SHA-pinned ref (e.g., actions/github-script@<commit-sha>) fetched from the actions/github-script v7 release; ensure the chosen SHA matches the intended v7 release to preserve behavior while preventing tag-moving supply-chain risks.
42-56: ⚡ Quick winLabel creation duplicates the canonical definition in labels.yml.
The inline label creation logic hardcodes properties (
color: 'B60205', description) that already exist in.github/labels.yml(lines 413-415), which declares itself the "single source of truth" for label configuration. Whilst this provides resilience if the label is accidentally deleted, it creates a maintenance burden and violates the DRY principle—if the canonical definition changes, this workflow must be updated separately.Consider either:
- Option A (preferred): Remove the creation logic and assume the label exists (managed via labels.yml sync)
- Option B: Add a comment documenting the intentional duplication and the resilience trade-off
♻️ Option A: Remove inline creation
- try { - await github.rest.issues.getLabel({ owner, repo, name: labelName }); - } catch (error) { - if (error.status === 404) { - await github.rest.issues.createLabel({ - owner, - repo, - name: labelName, - color: 'B60205', - description: 'Dependabot update appears security-related and eligible for guarded automation', - }); - } else { - throw error; - } - } - const existing = await github.rest.issues.listLabelsOnIssue({ owner, repo, issue_number });🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/dependabot-security-label.yml around lines 42 - 56, Remove the inline label-creation fallback and rely on the canonical labels.yml as the single source of truth: delete the catch branch that calls github.rest.issues.createLabel (the code that hardcodes color and description) and either let github.rest.issues.getLabel({ owner, repo, name: labelName }) surface a 404 error or rethrow it, keeping only the existence check logic that references labelName; if you prefer to keep a note, add a short comment near the getLabel call explaining that labels are managed via .github/labels.yml and intentional resilience was removed.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/dependabot-security-label.yml:
- Line 18: Replace the mutable tag usage of the GitHub Action by pinning
actions/github-script@v7 to a specific commit SHA: locate the line using "uses:
actions/github-script@v7" and update it to the corresponding SHA-pinned ref
(e.g., actions/github-script@<commit-sha>) fetched from the
actions/github-script v7 release; ensure the chosen SHA matches the intended v7
release to preserve behavior while preventing tag-moving supply-chain risks.
- Around line 42-56: Remove the inline label-creation fallback and rely on the
canonical labels.yml as the single source of truth: delete the catch branch that
calls github.rest.issues.createLabel (the code that hardcodes color and
description) and either let github.rest.issues.getLabel({ owner, repo, name:
labelName }) surface a 404 error or rethrow it, keeping only the existence check
logic that references labelName; if you prefer to keep a note, add a short
comment near the getLabel call explaining that labels are managed via
.github/labels.yml and intentional resilience was removed.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 7b4ab387-4acd-4c4f-964b-8a7b0342d1ba
📒 Files selected for processing (3)
.github/labels.yml.github/mergify.yml.github/workflows/dependabot-security-label.yml
✅ Files skipped from review due to trivial changes (1)
- .github/mergify.yml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: coderabbit-gate
- GitHub Check: check
🧰 Additional context used
📓 Path-based instructions (1)
**/.github/workflows/*.yml
⚙️ CodeRabbit configuration file
**/.github/workflows/*.yml: Review GitHub Actions workflows for this governance repo:
- Security: check for least-privilege permissions (use
permissions:at job level, default to read-only).- Secret handling: ensure secrets are passed via env vars, not interpolated directly into run: steps to prevent injection.
- Action pinning: prefer SHA-pinned actions over mutable tags (e.g.
actions/checkout@v4is acceptable; SHA pins are better).- No
pull_request_targetwith untrusted code execution unless explicitly justified.- Avoid storing sensitive outputs as unmasked step outputs.
- Check for reusable workflow patterns and matrix strategies where appropriate.
- Validate
on:triggers: ensure branch/path filters are present to avoid unnecessary runs.- Confirm workflows are documented, DRY, and maintainable.
- Ensure agent-triggered workflows use
workflow_dispatchwith defined inputs.
Files:
.github/workflows/dependabot-security-label.yml
🔇 Additional comments (4)
.github/labels.yml (1)
413-415: LGTM!.github/workflows/dependabot-security-label.yml (3)
3-6: LGTM!
31-40: LGTM!
58-75: LGTM!
🔍 Reviewer Summary for PR #563CI Status: ✅ Recommendations
|
ashleyshaw
removed
the
meta:needs-changelog
github-actions
Bot
added
area:documentation
🔍 Reviewer Summary for PR #563CI Status: ✅ Recommendations
|
🔍 Reviewer Summary for PR #563CI Status: ✅ Recommendations
|
🔍 Reviewer Summary for PR #563CI Status: ✅ Recommendations
|
1 participant
Summary
Add scoped Mergify automation so only eligible Dependabot security updates can auto-merge into develop after checks pass.
Changes
Why
Dependabot PRs were not auto-merging; this introduces a conservative policy that avoids auto-merging non-security dependency updates.
Validation
Related