Repository navigation
ci(dependabot): removed the paths filter from the auto-merge caller - #3
Merged
Merged
Conversation
The caller only started for src/Dockerfile and tools/Dockerfile, so a Dependabot PR of any other ecosystem never reached the auto-merge module: no job, no annotation, the PR just stayed open. The pip security update for src/requirements.txt (#1) is such a PR. Without the filter every Dependabot PR gets an explicit decision: * docker (src/Dockerfile) and pip (src/requirements.txt): merged only as patch updates and only after docker-release.yml ran on the PR head and passed. Its pull_request paths (src/**) already cover both files, and the image build ADDs requirements.txt and installs it, so the required workflow really exercises the update. * github-actions and any change under .github/: left open by the module's own CI guard, now with a visible notice. * any other file: left open as "not tested", because docker-release.yml does not start for it. Permissions, secrets, merge settings and required-workflows are unchanged; docker-release.yml needed no wider paths.
Contributor
|
🎉 This PR is included in version 0.6.4 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The Dependabot auto-merge caller (
docker-maintenance.yml) only started forsrc/Dockerfileandtools/Dockerfile. A Dependabot PR of any other ecosystem never reacheddocker-maintenance-dependabot.yml: no job, no annotation, it just stayed open without anyone noticing. #1 (pip,src/requirements.txt) is exactly such a PR. Owner decision: the module must react to every Dependabot ecosystem.What
paths:filter from the caller'spull_requesttrigger;types: [opened, synchronize, reopened, ready_for_review]stay.Per ecosystem after this change:
src/Dockerfiledocker-release.ymlstarts onsrc/**and builds the image on the PR - unchanged behaviourdependabot.yml)src/requirements.txtADDsrequirements.txtanddocker-setup-requirements.shinstalls it (see the build log of #1:Collecting Flask==3.1.3 (from -r requirements.txt (line 1))).github/workflows/**docker-release.ymldoes not start for itCompatibility
permissions,secrets: inherit,merge-method,auto-approveandrequired-workflowsare unchanged. The repository is public, so the module needs nochecks/statuses/actions: read.docker-release.ymlis unchanged: itspull_requestpaths (src/**,docker-compose*.yml,.dockerignore) already cover everything that can auto-merge.dependabot[bot]filter (no runner minutes beyond the skip).Test
pull_requestwith the four types only.docker-release.ymldoes not run because only.github/changed.@dependabot recreate).