Give the AGT reference implementation Dependabot coverage - #126
Open
rocklambros wants to merge 1 commit into
Open
rocklambros wants to merge 1 commit into
rocklambros wants to merge 1 commit into
Conversation
reference-implementations/agt is a Bun workspace with its own npm dependencies, and nothing proposed updates for them. Dependabot has no security updates for Bun, so a version-update entry is the only automated path. The entry uses the same 7-day cooldown as the other ecosystems. agent-control-specification is ignored because agt.lock pins it to the vendored AGT commit and test/pin.test.ts fails when package.json and the lock disagree. That SDK moves with agt_ref as one deliberate change. Signed-off-by: rocklambros <rock@rockcyber.com>
rocklambros
requested review from
GangGreenTemperTatum,
afogel,
bar-capsule,
fewdisc,
mamicidal and
sclintonowasp
as code owners
September 15, 2026 13:49
github-actions
Bot
added
the
status:needs-triage
This comment has been minimized.
This comment has been minimized.
rocklambros
removed
the
status:needs-triage
rocklambros
added a commit
that referenced
this pull request
Sep 17, 2026
… one pass (#158) Follow-up to #157, fixing a defect I found by testing the merged workflow rather than one a reviewer would have caught from the diff. ## The defect A reconcile run that adds items cannot also set their Status. Adding an item triggers project 9's own `Item added to project` workflow, which stamps a default Status asynchronously. `apply_governance.py` builds its entire plan before executing any of it, so on a run that adds anything it has already decided the Status actions before those items exist on the board. The default lands after the run finishes and nothing corrects it until the next run. ## Measured, not theorised On the 2026-09-17 backfill the first pass made **40 adds and 1 Status change**. A second pass run immediately afterwards found **5 more Status corrections waiting**: | Item | Why the default was wrong | | --- | --- | | #135 | `status:accepted` | | #131 | `status:accepted` | | #126 | open pull request, belongs in In progress | | #113 | open pull request | | #112 | open pull request | None of those five has the default as its correct Status, which is precisely the population a single pass strands. A third pass reported zero actions, so the tool converges, it just cannot converge in one run when it is also adding. Nightly, that is up to 24 hours of a board reading Needs triage for work that is accepted or in flight. That is the failure the board exists to prevent, so shipping #157 without this would have left the automation quietly wrong in the one case it most needed to be right. ## The fix Run the board step twice under `--apply`. The dry-run path still runs once and returns, since printing the same plan twice helps nobody. The reconciler is idempotent, so the second pass costs one API listing on a run that added nothing. Once `Auto-add to project` is enabled on the project, that is every run. ## Note on review I did not admin-merge this one. #157 was merged under the administrative authorisation given for it specifically, and extending that to a second change on my own judgement is the kind of thing that should be asked for rather than assumed. The workflow is inert until the App and environment exist, so there is no urgency in merging this ahead of a normal review. Signed-off-by: Rock Lambros <rock@rockcyber.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Adds a Bun entry to
.github/dependabot.ymlforreference-implementations/agt. That workspace has its own npm dependencies, and until now nothing proposed updates for them. Dependabot has no security updates for Bun, so this version-update entry is the only automated path. It uses the same 7-day cooldown as the GitHub Actions and uv entries.Dependabot reads the workspace list from the root
package.json, so one entry covers all five packages and both hosts, and its Bun updater rewritesbun.lockalongside the manifests. CI'sbun install --frozen-lockfileaccepts that.agent-control-specification*is ignored.agt.lockpins that SDK to the vendored AGT commit, andtest/pin.test.tsfails whenpackage.jsonand the lock disagree, so the SDK moves withagt_refas one deliberate change. The header comment now says Bun is the exception to security updates covering everything.Which issue does this implement
Closes #127
Base branch
integration, because this touches the specification, schemas, a referenceimplementation, an adapter, tests, or CI
main, because every changed path is on the documentation lane allowlist inCONTRIBUTING.md
Type of change
I tested this
uv run pytest -vpasses on my machineuv run mkdocs build --strictpasses on my machineThe config validates against the SchemaStore
dependabot-2.0.jsonschema with zero errors, and a copy with a misspelled ecosystem and cooldown key produces two. For the ignore rule,bun test test/pin.test.tspasses 4 of 4 on an unmodified tree and failspins the SDK version the bridge installsafter bumping only the SDK inpackage.json.The first live Dependabot run can only be checked after merge, under Insights, Dependency graph, Dependabot.
Checklist
git commit -s(required by the DCO)Security
Dependabot will open pull requests that change the AGT reference implementation's dependency tree. Each one waits 7 days after an upstream release, runs the Reference implementation workflow, and needs code-owner review under
/reference-implementations/.