Heal Dependabot hygiene from the pins catalog - #677
Conversation
Copy maplibre-compose's Dependabot hygiene flow: fix-action-pins rewrites consumers from the catalog, and the hygiene job commits mise run fix on same-repo Dependabot pull requests. Co-authored-by: Sargun Vohra <sargunv@users.noreply.github.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Greptile SummaryThe PR adds automatic action-pin healing for same-repository Dependabot pull requests.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| .mise/tasks/ci/commit-hygiene-fixes | Adds a task that commits tracked hygiene changes, pushes the Dependabot branch, and dispatches CI. |
| .mise/tasks/ci/generate-workflow | Generates the Dependabot-aware hygiene checkout, repair, commit, and workflow-dispatch sequence. |
| ci/action_pins.py | Extends action-pin validation with deterministic rewriting of mismatched consumer references. |
| ci/tests/test_action_pins.py | Covers pin checking, rewriting, idempotence, consumer discovery, and newline normalization. |
| .github/workflows/ci.yml | Updates generated CI with Dependabot hygiene healing and manual workflow dispatch support. |
Sequence Diagram
sequenceDiagram
participant D as Dependabot PR
participant H as Hygiene job
participant P as Pin fixer
participant G as Git branch
participant C as Dispatched CI
D->>H: pull_request event
H->>P: mise run fix
P-->>H: Rewrite consumers from pin catalog
H->>H: Regenerate workflow and generators
H->>G: Commit and push hygiene changes
H->>C: Dispatch CI on updated branch
Reviews (2): Last reviewed commit: "Heal generated workflow pins before hygi..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| fi | ||
| if [[ ${committed} != true && $(git log -1 --pretty=%s) != "chore: apply hygiene fixes" ]]; then | ||
| exit 0 |
There was a problem hiding this comment.
When the workflow is rerun after a previous invocation pushed chore: apply hygiene fixes, the clean tree still bypasses this early return based solely on the tip commit message. The script then pushes an unchanged branch and starts another complete CI workflow for the same commit, wasting CI capacity and potentially producing concurrent runs for one SHA.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4ca1d0eeb0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| " permissions:", | ||
| " contents: write", | ||
| " actions: write", |
There was a problem hiding this comment.
When DEPENDABOT_PR is true, this job was triggered by a Dependabot pull_request; GitHub treats these runs like fork-originated workflows and gives them a read-only GITHUB_TOKEN, despite the requested write scopes (GitHub documentation). Consequently, commit-hygiene-fixes can create its local commit, but git push fails with a permission error, so neither the fix nor the follow-up dispatch reaches the branch.
Useful? React with 👍 / 👎.
| " - id: apply-fix", | ||
| " if: env.DEPENDABOT_PR == 'true'", | ||
| " env:", | ||
| " GH_TOKEN: ${{ github.token }}", | ||
| " HEAD_REF: ${{ github.head_ref }}", | ||
| " run: mise run ci:commit-hygiene-fixes", |
There was a problem hiding this comment.
When Dependabot updates .github/workflows/action-pins.yml, the generator immediately expects .github/workflows/ci.yml to contain the new catalog references, but mise run ci:generate-workflow --check runs at line 269 before mise run fix, which is the first command that invokes the new action-pin fixer. The hygiene job therefore exits on the stale generated workflow and never reaches this commit step, defeating the healing flow for every action-pin update.
Useful? React with 👍 / 👎.
| if ! git diff --quiet || ! git diff --cached --quiet; then | ||
| git add --update |
There was a problem hiding this comment.
When mise rewrites any tracked root mise*.lock file during a Dependabot hygiene run, this unrestricted dirty-tree check stages and commits it, even though the workflow's existing generated-file check deliberately excludes those files at lines 289-290. This turns tolerated, runner-generated lockfile changes into bot-authored dependency-PR changes and can trigger an unnecessary full CI dispatch; apply the same path exclusion when deciding what to commit and when staging it.
Useful? React with 👍 / 👎.
Dependabot catalog bumps must rewrite ci.yml after mise run fix, or generate-workflow --check fails first. Keep mise.lock out of the hygiene commit the same way the final diff check does. Co-authored-by: Sargun Vohra <sargunv@users.noreply.github.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 28ccd6e45c
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| " permissions:", | ||
| " contents: write", | ||
| " actions: write", |
There was a problem hiding this comment.
When a non-Dependabot same-repository pull request runs hygiene, this job-level block still grants every PR-controlled step—including ./.github/actions/setup-ci-deps and the mise tasks—contents: write and actions: write; the later DEPENDABOT_PR conditions restrict only checkout and commit steps, not token availability. Because actions can access github.token even when it is not passed explicitly, code introduced by such a PR can mutate repository contents or workflow runs before review. Keep the general hygiene job read-only and move the privileged healing path into a separately constrained job or event.
Useful? React with 👍 / 👎.
| git push | ||
| # GITHUB_TOKEN pushes do not start new workflow runs, so dispatch CI on the | ||
| # updated branch after the push. | ||
| gh workflow run CI --ref "${HEAD_REF}" |
There was a problem hiding this comment.
When hygiene pushes a generated-fix commit, the push deliberately creates no pull_request run, and this replacement dispatch uses HEAD_REF; gh workflow run --help defines --ref as the “Branch or tag name which contains the version of the workflow file,” so the resulting run checks the raw Dependabot branch and has no pull-request merge ref or payload. The earlier PR run remains attached to the pre-fix commit, meaning the final required checks never test the healed commit merged with the current base branch. Trigger the follow-up in a way that preserves pull-request merge-context coverage.
Useful? React with 👍 / 👎.
2 participants
Summary
Copy maplibre-compose's Dependabot hygiene flow so
mise run fixrewrites action pins and the hygiene job commits the result on same-repo Dependabot pull requests.Test plan
Ran
ci:test-release-tools,ci:check-action-pins, andci:generate-workflow --check.AI assistance
ci:fix-action-pins, andci:commit-hygiene-fixesfrom maplibre-compose.