Repository navigation
ci: restrict Dependabot auto-merge to classified minor and patch updates - #91
Merged
imran-siddique merged 1 commit intoOct 15, 2026
Conversation
Signed-off-by: Srinivasa Dinakar Jainti <dinakarjs@gmail.com>
|
🟡 Contributor Check: MEDIUM
Automated check by AgenTrust Contributor Check. |
github-actions
Bot
added
the
needs-review:MEDIUM
imran-siddique
merged commit Oct 15, 2026
7c1c719
into
agentrust-io:ci/dependabot-grouping
9 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supplement to #89 at
57c744681f9f331d401d97dfe5a2d1ee53042a86. The proposed workflow queues every Dependabot PR, including majors, and does not rerun when Dependabot updates it. Addsynchronize, SHA-pinned verified Dependabot metadata, a gate requiring every update in a nonempty group to be classified semver minor or patch, and event-head matching ongh pr merge. Major, unknown and malformed metadata stays manual.Ports the safeguards from weight-custody-manifest#196, integrations#324, agent-manifest#505, cmcp#758, ca2a#253 and trace-spec#523. Existing Telemetry Python majors remain individual PRs; no Dependabot policy or comment changes are needed. Bot/same-repository restrictions, permissions and existing approval/check requirements remain. No contract, schema, runtime or dependency changes.
Tests follow this repository's unittest convention using only the standard library: 13 metadata cases, malformed JSON refusal and event/permission/pinning/environment checks. They execute the actual Bash block with real jq and a stubbed gh command; existing CI discovery collects them. In a temporary copy, bypassing the gate causes six refusal controls (major, unknown, empty, mixed, non-object, malformed) to fail while the positive patch control passes. No mutation committed.
Validation on Python 3.12.14 with the hash-locked test environment and local editable package: full unittest suite ran 148 tests, 2 skipped, with no failures. Removed inherited OTEL_TRACES_SAMPLER=parentbased_traceidratio and OTEL_TRACES_SAMPLER_ARG=0.01 for that run; the initial inherited 1% sampling caused three span-observation failures. Version, bundled schemas, OTel compatibility, TypeScript-schema parity and all conformance fixture checks passed. Targeted Ruff, formatting and whitespace checks passed. TypeScript code is unchanged; npm tests were not rerun locally.
Maintainer integration and hosted CI remain required. The first genuine Dependabot run still needs bot-path validation after integration; this human-authored PR does not exercise that actor path. No approval or merge performed.
Signed-off-by: Srinivasa Dinakar Jainti dinakarjs@gmail.com