Repository navigation
fix: auto-remove semver labels from Dependabot PRs to fix CI checks - #1462
Conversation
Dependabot automatically adds semver labels (major/minor/patch) based on dependency version changes, which conflicts with our 'no-release' label. Since dependency updates don't directly determine Atmos releases, this workflow step removes the auto-added semver labels from Dependabot PRs. This is a workaround for a known GitHub limitation tracked in: - dependabot/dependabot-core#3465 - dependabot/dependabot-core#11783 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
|
Important Cloud Posse Engineering Team Review RequiredThis pull request modifies files that require Cloud Posse's review. Please be patient, and a core maintainer will review your changes. To expedite this process, reach out to us on Slack in the |
📝 WalkthroughWalkthroughUpdates GitHub Actions: grants explicit permissions to the pr-semver-labels job, adds a Dependabot-only cleanup step using a local composite action to remove auto-added semver labels, and enforces a preflight check requiring exactly one of Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant PR as Pull Request
participant WF as Workflow (codeql.yml)
participant Job as Job: pr-semver-labels
participant Act as Action: remove-dependabot-semver-labels
participant GH as GitHub API
PR->>WF: workflow triggered
WF->>Job: start (with explicit write permissions)
alt actor == dependabot[bot]
Job->>Act: run Dependabot cleanup (local composite action)
Act->>GH: list PR labels
GH-->>Act: labels list
Act->>GH: remove semver labels (major/minor/patch) [per-label calls]
GH-->>Act: removal responses
Act->>Job: report removals & warn if `no-release` missing
else actor != dependabot
Job-->>Job: skip Dependabot cleanup step
end
Job->>GH: run required-labels check (exactly one of major/minor/patch/no-release)
GH-->>Job: pass/fail (comment on failure if configured)
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
Warning Review ran into problems🔥 ProblemsGit: Failed to clone repository. Please run the ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (3)
.github/workflows/codeql.yml (3)
129-131: Detect Dependabot PRs by author, not triggering actor.Actor can be a maintainer or another action on later events; the PR author is stable.
Apply this diff:
- if: github.actor == 'dependabot[bot]' + if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
175-180: Auto-addno-releasewhen missing to avoid flaky failures.If repo settings ever miss the default, the next step will fail. Add it here.
Apply this diff:
- const hasNoRelease = labels.some(l => l.name === 'no-release'); - if (!hasNoRelease) { - console.log('Warning: no-release label is missing from this Dependabot PR'); - } + const hasNoRelease = labels.some(l => l.name === 'no-release'); + if (!hasNoRelease) { + console.log('no-release label missing; adding it to this Dependabot PR'); + try { + await github.rest.issues.addLabels({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: context.issue.number, + labels: ['no-release'] + }); + console.log('✓ Added: no-release'); + } catch (error) { + console.warn(`Could not add no-release: ${error.message}`); + } + }
110-180: Trim trailing whitespace to satisfy yamllint.Multiple lines in this block have trailing spaces (e.g., Lines 111, 112, 113, 116, 117, 135, 142, 144, 151, 155, 169, 174, 180). Strip them to keep CI green.
Minimal fix (representative; remove end-of-line spaces):
- # + # - console.log('Removing auto-added semver labels (see workflow comments for GitHub issue links)'); + console.log('Removing auto-added semver labels (see workflow comments for GitHub issue links)'); - + - + - +Tip: run yamlfmt or a pre-commit hook to auto-fix trailing spaces.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/codeql.yml(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: aknysh
PR: cloudposse/atmos#944
File: go.mod:206-206
Timestamp: 2025-01-17T00:18:57.769Z
Learning: For indirect dependencies with license compliance issues in the cloudposse/atmos repository, the team prefers to handle them in follow-up PRs rather than blocking the current changes, as these issues often require deeper investigation of the dependency tree.
Learnt from: Listener430
PR: cloudposse/atmos#934
File: tests/fixtures/scenarios/docs-generate/README.md.gotmpl:99-118
Timestamp: 2025-01-25T03:51:57.689Z
Learning: For the cloudposse/atmos repository, changes to template contents should be handled in dedicated PRs and are typically considered out of scope for PRs focused on other objectives.
🪛 YAMLlint (1.37.1)
.github/workflows/codeql.yml
[error] 111-111: trailing spaces
(trailing-spaces)
[error] 112-112: trailing spaces
(trailing-spaces)
[error] 113-113: trailing spaces
(trailing-spaces)
[error] 116-116: trailing spaces
(trailing-spaces)
[error] 117-117: trailing spaces
(trailing-spaces)
[error] 135-135: trailing spaces
(trailing-spaces)
[error] 142-142: trailing spaces
(trailing-spaces)
[error] 144-144: trailing spaces
(trailing-spaces)
[error] 151-151: trailing spaces
(trailing-spaces)
[error] 155-155: trailing spaces
(trailing-spaces)
[error] 169-169: trailing spaces
(trailing-spaces)
[error] 174-174: trailing spaces
(trailing-spaces)
[error] 180-180: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (9)
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: Lint (golangci)
- GitHub Check: Analyze (go)
- GitHub Check: Build (macos-latest, macos)
- GitHub Check: Build (windows-latest, windows)
- GitHub Check: Build (ubuntu-latest, linux)
- GitHub Check: Analyze (go)
- GitHub Check: Lint (golangci)
- GitHub Check: Summary
🔇 Additional comments (1)
.github/workflows/codeql.yml (1)
106-109: LGTM on explicit job permissions.Sufficient for label reads/writes and comments in this job.
Erik Osterman (Cloud Posse) (osterman)
added
the
no-release
- Move the label cleanup script to .github/actions/remove-dependabot-semver-labels - Keep workflow cleaner and more maintainable - Makes the logic reusable for other workflows if needed - Added checkout step (required for local composite actions) The action contains all the documentation about why this workaround is necessary, including links to relevant GitHub issues. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
Updated: Refactored into a reusable actionI've refactored the solution to make the workflow cleaner and more maintainable: Changes in this update:
Benefits:
The functionality remains exactly the same - it will remove auto-added semver labels from Dependabot PRs while preserving the |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1462 +/- ##
==========================================
+ Coverage 55.94% 55.98% +0.04%
==========================================
Files 274 274
Lines 28936 28936
==========================================
+ Hits 16188 16201 +13
+ Misses 10956 10941 -15
- Partials 1792 1794 +2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
.github/actions/remove-dependabot-semver-labels/action.yml(1 hunks).github/workflows/codeql.yml(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: aknysh
PR: cloudposse/atmos#944
File: go.mod:206-206
Timestamp: 2025-01-17T00:18:57.769Z
Learning: For indirect dependencies with license compliance issues in the cloudposse/atmos repository, the team prefers to handle them in follow-up PRs rather than blocking the current changes, as these issues often require deeper investigation of the dependency tree.
Learnt from: Listener430
PR: cloudposse/atmos#934
File: tests/fixtures/scenarios/docs-generate/README.md.gotmpl:99-118
Timestamp: 2025-01-25T03:51:57.689Z
Learning: For the cloudposse/atmos repository, changes to template contents should be handled in dedicated PRs and are typically considered out of scope for PRs focused on other objectives.
🪛 YAMLlint (1.37.1)
.github/actions/remove-dependabot-semver-labels/action.yml
[error] 4-4: trailing spaces
(trailing-spaces)
[error] 8-8: trailing spaces
(trailing-spaces)
[error] 26-26: trailing spaces
(trailing-spaces)
[error] 29-29: trailing spaces
(trailing-spaces)
[error] 36-36: trailing spaces
(trailing-spaces)
[error] 38-38: trailing spaces
(trailing-spaces)
[error] 45-45: trailing spaces
(trailing-spaces)
[error] 49-49: trailing spaces
(trailing-spaces)
[error] 63-63: trailing spaces
(trailing-spaces)
[error] 68-68: trailing spaces
(trailing-spaces)
[error] 74-74: no new line character at the end of file
(new-line-at-end-of-file)
.github/workflows/codeql.yml
[error] 113-113: trailing spaces
(trailing-spaces)
[error] 117-117: trailing spaces
(trailing-spaces)
[error] 120-120: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
- GitHub Check: Build (ubuntu-latest, linux)
- GitHub Check: Build (windows-latest, windows)
- GitHub Check: Analyze (go)
- GitHub Check: Lint (golangci)
- GitHub Check: Summary
🔇 Additional comments (8)
.github/actions/remove-dependabot-semver-labels/action.yml (4)
1-13: Well-structured action definitionGood documentation explaining the purpose and linking to relevant GitHub issues. The action clearly articulates why this workaround is needed.
21-25: Solid early exit for non-Dependabot PRsClean guard clause that prevents unnecessary processing for regular PRs.
50-62: Good error handling in the removal loopIndividual label removal wrapped in try-catch prevents one failure from blocking others.
69-74: Helpful verification of no-release labelSmart to check that the expected label is present and warn if missing. This helps catch configuration issues early.
.github/workflows/codeql.yml (4)
106-108: Appropriate permissions addedGood addition of write permissions for pull-requests and issues to support the label management functionality.
110-112: Smart conditional checkoutOnly checking out code when needed for Dependabot PRs is efficient and avoids unnecessary operations.
114-119: Well-implemented Dependabot cleanup stepClear comments explaining the purpose and proper conditional execution. The local action reference looks correct.
123-139: Solid semver label enforcementThe required labels check with automatic comment generation will help maintain consistent labeling practices. The warning message is clear and actionable.
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (6)
.github/actions/remove-dependabot-semver-labels/action.yml (5)
18-19: Pin action to a commit SHAFor supply-chain hardening, pin
actions/github-scriptto a specific commit SHA rather than a floating tag.- uses: actions/github-script@v7 + uses: actions/github-script@60a0d83039c74c5b7c1b19100b2000b3440eb6b0 # v7
41-45: Make label detection case-insensitiveAvoid surprises if labels are cased differently. Normalize before comparison.
- const semverLabels = ['major', 'minor', 'patch']; - const autoAddedLabels = labels - .filter(label => semverLabels.includes(label.name)) + const semverLabels = ['major', 'minor', 'patch']; + const autoAddedLabels = labels + .filter(label => semverLabels.includes(label.name.toLowerCase())) - .map(label => label.name); + .map(label => label.name);
69-74: Optionally auto-addno-releasewhen missingIf repo config drifts, the follow-up “exactly one label” check will fail. Consider adding it proactively.
- const hasNoRelease = labels.some(l => l.name === 'no-release'); - if (!hasNoRelease) { - console.log('⚠️ Warning: no-release label is missing from this Dependabot PR'); - console.log(' This label should be added via .github/dependabot.yml configuration'); - } + const hasNoRelease = labels.some(l => l.name === 'no-release'); + if (!hasNoRelease) { + console.log('no-release label missing; adding it now'); + await github.rest.issues.addLabels({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: context.issue.number, + labels: ['no-release'], + }); + }
4-4: Fix YAML lint nits (trailing spaces, EOF newline)Trim trailing spaces and add a newline at EOF to satisfy yamllint.
+# (ensure file ends with a single newline)Also applies to: 8-8, 26-26, 29-29, 36-36, 38-38, 45-45, 49-49, 63-63, 68-68, 74-74
14-16: Consider exposing a token inputIf reused elsewhere, allowing a
github-tokeninput (defaulting to${{ github.token }}) makes the action more flexible.runs: using: 'composite' steps: - name: Remove auto-added semver labels - uses: actions/github-script@v7 + uses: actions/github-script@v7 with: + github-token: ${{ inputs.github-token || github.token }} script: | // ...And add at the top:
name: 'Remove Dependabot Semver Labels' description: | Removes auto-added semver labels (major/minor/patch) from Dependabot PRs. +inputs: + github-token: + description: Token with permissions to read/write labels + required: false.github/workflows/codeql.yml (1)
117-117: Trim trailing spacesYAML lint errors on trailing spaces.
- - name: Clean up Dependabot labels + - name: Clean up Dependabot labelsAlso applies to: 120-120
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
.github/actions/remove-dependabot-semver-labels/action.yml(1 hunks).github/workflows/codeql.yml(1 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
.github/actions/remove-dependabot-semver-labels/action.yml
[error] 4-4: trailing spaces
(trailing-spaces)
[error] 8-8: trailing spaces
(trailing-spaces)
[error] 26-26: trailing spaces
(trailing-spaces)
[error] 29-29: trailing spaces
(trailing-spaces)
[error] 36-36: trailing spaces
(trailing-spaces)
[error] 38-38: trailing spaces
(trailing-spaces)
[error] 45-45: trailing spaces
(trailing-spaces)
[error] 49-49: trailing spaces
(trailing-spaces)
[error] 63-63: trailing spaces
(trailing-spaces)
[error] 68-68: trailing spaces
(trailing-spaces)
[error] 74-74: no new line character at the end of file
(new-line-at-end-of-file)
.github/workflows/codeql.yml
[error] 113-113: trailing spaces
(trailing-spaces)
[error] 117-117: trailing spaces
(trailing-spaces)
[error] 120-120: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Summary
🔇 Additional comments (2)
.github/workflows/codeql.yml (2)
106-109: Good: minimal permissions for label opsGranting
pull-requests: writeandissues: writeis appropriate for label cleanup.
121-139: Label policy looks solidRequiring exactly one of major/minor/patch/no-release with a helpful comment is clear and enforceable.
- Fixed Dependabot detection to check PR author instead of context.actor - Changed from context.actor to context.payload.pull_request.user.login in action - Changed from github.actor to github.event.pull_request.user.login in workflow - Removed trailing whitespace from action.yml and codeql.yml - Ensured action.yml ends with proper newline (POSIX-compliant) The PR author check is more reliable than actor check because actor can vary based on the event type (e.g., label events might show a different actor). 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
Fixed: Dependabot detection logic and whitespace issuesChanges in this update:
The PR author check ensures we correctly identify Dependabot PRs regardless of who triggered the workflow event. |
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (1)
.github/workflows/codeql.yml (1)
114-120: Tighten condition + trim trailing whitespace.
- Same redundancy here; simplify the if.
- Also remove trailing spaces on Lines 113, 117, and 120 (yamllint flagged).
- if: github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]' + if: github.event.pull_request.user.login == 'dependabot[bot]'
🧹 Nitpick comments (1)
.github/workflows/codeql.yml (1)
110-113: Simplify step condition (job already gated to pull_request).Drop the redundant event-name check.
- if: github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]' + if: github.event.pull_request.user.login == 'dependabot[bot]'
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
.github/actions/remove-dependabot-semver-labels/action.yml(1 hunks).github/workflows/codeql.yml(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/actions/remove-dependabot-semver-labels/action.yml
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: aknysh
PR: cloudposse/atmos#944
File: go.mod:206-206
Timestamp: 2025-01-17T00:18:57.769Z
Learning: For indirect dependencies with license compliance issues in the cloudposse/atmos repository, the team prefers to handle them in follow-up PRs rather than blocking the current changes, as these issues often require deeper investigation of the dependency tree.
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Build (windows-latest, windows)
- GitHub Check: Summary
🔇 Additional comments (2)
.github/workflows/codeql.yml (2)
106-108: Permissions scoped correctly for label mutations.pull-requests: write and issues: write are sufficient for label cleanup. Good.
121-123: Preflight label check is well placed.Runs after cleanup and enforces exactly one of the semver/no-release labels. Good.
|
These changes were released in v1.190.0-test.1. |
…1462) * fix: remove auto-added semver labels from Dependabot PRs Dependabot automatically adds semver labels (major/minor/patch) based on dependency version changes, which conflicts with our 'no-release' label. Since dependency updates don't directly determine Atmos releases, this workflow step removes the auto-added semver labels from Dependabot PRs. This is a workaround for a known GitHub limitation tracked in: - dependabot/dependabot-core#3465 - dependabot/dependabot-core#11783 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * refactor: extract Dependabot label cleanup into reusable action - Move the label cleanup script to .github/actions/remove-dependabot-semver-labels - Keep workflow cleaner and more maintainable - Makes the logic reusable for other workflows if needed - Added checkout step (required for local composite actions) The action contains all the documentation about why this workaround is necessary, including links to relevant GitHub issues. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> * fix: correct Dependabot detection and remove trailing whitespace - Fixed Dependabot detection to check PR author instead of context.actor - Changed from context.actor to context.payload.pull_request.user.login in action - Changed from github.actor to github.event.pull_request.user.login in workflow - Removed trailing whitespace from action.yml and codeql.yml - Ensured action.yml ends with proper newline (POSIX-compliant) The PR author check is more reliable than actor check because actor can vary based on the event type (e.g., label events might show a different actor). 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
2 participants
Summary
no-releaselabelProblem
Dependabot automatically adds semver labels (
major,minor,patch) based on the version changes of dependencies. This causes our PR checks to fail because:no-release(from our config) AND a semver label (auto-added)Solution
This PR adds a preprocessing step in the
pr-semver-labelsjob that:no-releaselabelRationale
References
This is a workaround for a known GitHub limitation. See:
major/minor/patchlabels dependabot/dependabot-core#3465 (Feature request to opt-out)Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit