Automate bot PR maintenance end-to-end - #385
Conversation
This comment has been minimized.
This comment has been minimized.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #385 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 19 19
Lines 674 674
Branches 88 88
=========================================
Hits 674 674
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0e2e719057
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| automate: | ||
| name: Label and enable auto-merge | ||
| if: >- | ||
| github.event.pull_request.user.login == 'dependabot[bot]' || |
There was a problem hiding this comment.
When this job is triggered by a Dependabot PR, it matches this condition, but GitHub treats Dependabot-triggered pull_request_target runs whose PR user is dependabot[bot] as read-only and without Actions secrets (see GitHub's Dependabot-on-Actions restrictions: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-on-actions#restrictions-when-dependabot-triggers-events). That means AUTO_MERGE_PAT is unavailable and the fallback GITHUB_TOKEN cannot run the later gh pr edit/gh pr merge --auto writes, so weekly Dependabot PRs will fail this workflow instead of getting auto-merge enabled.
Useful? React with 👍 / 👎.
Both the changelog and heal jobs now run add_changelog_entry.py from a checkout of main (trusted code), only ever treating the PR branches' content as data. Previously the script was executed from the PR branch itself, contradicting the workflow's security claim.
…ening # Conflicts: # requirements/cicd_utils.txt
…OKEN The fallback did not just degrade the experience, it deadlocked the automation: pushes and merges performed with GITHUB_TOKEN do not trigger other workflows, so CI would never run on the changelog commits pushed to bot PRs, the required status checks would stay pending forever, and auto-merge would never fire. Every job now fails fast with an actionable error when the secret is missing.
Routing bot PRs into their own 'Dependencies' subsection keeps the 'CI/CD' subsection free for meaningful pipeline changes (and matches the subsection name already used by past releases). Entries are kept sorted alphabetically: the whole list is re-sorted on every insertion, which repairs manual ordering violations and, as a bonus, makes two open bot PRs less likely to collide on the same changelog line. Existing bot entries in the unreleased section were migrated to the new format; published release notes are left untouched.
"Bot PRs" only named the subject; "Bot PR automation" describes what the workflow actually does (changelog entries, auto-merge, and conflict healing for trusted bot PRs) and reads better in check contexts (e.g., "Bot PR automation / Add changelog entry").
With "require branches to be up to date before merging" enabled, auto-merge waits forever on bot PRs that merely fell behind main, since nothing else updates their branches. The heal job now detects staleness locally (is the tip of main an ancestor of the PR branch?) and merges main into any bot PR that lacks it, covering both the behind and the conflicted cases with a single code path. This also removes the flaky polling of GitHub's asynchronous mergeability computation.
Requiring this single, stable context instead of enumerating each matrix job means adding or dropping Python versions never requires touching the repository's required status checks (a stale required context would otherwise block every PR until manually removed).
1 participant
Automates the recurring dependabot / pre-commit.ci PR chores so that the only human action left is a quick review + approval.
How it works
.github/dependabot.yml: switch from daily per-dependency PRs to a single weekly grouped PR per ecosystem (less noise, fewer overlapping bot PRs)..github/workflows/bot-prs.yml(new): for PRs authored bydependabot[bot]orpre-commit-ci[bot]:cicd_utils/cicd/scripts/add_changelog_entry.pyhelper), so the "Check for entry in Changelog" requirement passes and the entry is reviewable as part of the PR diff itself.synchronizeevent re-adds it.main) detects open bot PRs that became conflicted — e.g., two bot PRs whose changelog entries collide once the first one merges — and resolves them by mergingmaininto the PR branch and regenerating the entry.add_changelog_entry.py: inserts- <title> ({gh-pr}N)underUnreleased changes > ### CI/CD, creating the subsection or the whole section when missing. Fully unit-tested (100% diff coverage).cicd_utils/find-unmentioned-prs.shnow prints ready-to-paste changelog entries for any merged PR that's still missing from the changelog (release-time safety net).AUTO_MERGE_PATsecret (fine-grained PAT, this repo only, contents:write + pull-requests:write): without it, the workflow falls back toGITHUB_TOKEN, whose pushes/merges do not trigger other workflows — meaning no CI runs on the changelog commit and no post-merge CI/TestPyPI publish on main.main(Settings → Branches): auto-merge only waits for required checks. Suggested contexts:Static checks, the fiveSoftware tests (3.x, ubuntu-latest)jobs,Check for entry in Changelog, andBuild distributions(leave "require branches to be up to date" off).📚 Documentation preview 📚: https://ridgeplot--385.org.readthedocs.build/en/385/