chore: update dependabot-rebase-reusable SHA (fix update-branch + mergeable) - #127
Conversation
Fix: use update-branch API with APP_TOKEN instead of @dependabot rebase Fix: trust GitHub mergeable state instead of checking all checks
|
Warning Rate limit exceeded
To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe ChangesReusable Workflow Reference Update
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/dependabot-rebase.yml:
- Line 43: Update the misleading inline comment next to the permission
declaration for pull-requests by replacing or augmenting the text "# post
`@dependabot` rebase comments" with a short, accurate note that the permission
"pull-requests: write" is still required but the workflow now uses the
update-branch API (not posting rebase comments); locate the comment adjacent to
the "pull-requests: write" permission in the reusable workflow and edit it to
reflect this new behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 1a3f19fe-65f7-43ab-aef2-9e440cc23128
📒 Files selected for processing (1)
.github/workflows/dependabot-rebase.yml
There was a problem hiding this comment.
Pull request overview
This PR updates the thin caller workflow .github/workflows/dependabot-rebase.yml to point at a newer pinned commit SHA of the org-level reusable workflow, aligning this repo with the latest Dependabot rebase behavior described in the PR.
Changes:
- Bump
petry-projects/.github/.github/workflows/dependabot-rebase-reusable.ymlreference from3ac78a9…tob51e2ed….
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| @@ -41,7 +41,7 @@ jobs: | |||
| dependabot-rebase: | |||
| permissions: | |||
| pull-requests: write # post @dependabot rebase comments and re-approve PRs | |||
There was a problem hiding this comment.
Fixed in the latest commit — updated the pull-requests: write comment to # call update-branch API on behind PRs and merge when ready, which accurately reflects the new mechanism. Thanks for catching this.
… API Addresses reviewer feedback: the inline comment on pull-requests: write still referenced @dependabot rebase (the old mechanism). The reusable workflow now uses the update-branch API with APP_TOKEN instead.
|
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 97792a1387fa21f7a7940087572988e831a93f17
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6)
Summary
This PR bumps the pinned SHA of the org-level reusable Dependabot workflow to fix two documented issues: GitHub App bots being rejected by @dependabot rebase, and non-required failing checks (e.g. gitleaks false positives) incorrectly blocking auto-merge. All CI gates pass, the SHA is pinned to the org's own .github repo, and the behavioral changes are intentional and well-documented. No new secrets, no hardcoded credentials, no injection risks found.
Findings
- INFO: SHA bump from 3ac78a9b to b51e2edf in a pinned reusable workflow reference — good security practice. The reusable workflow lives in the org's own petry-projects/.github repo (trusted scope, not a third-party action).
- INFO: Mechanism for updating behind Dependabot PRs changed from posting '@dependabot rebase' comments to calling the update-branch API with APP_TOKEN. Root cause is documented: Dependabot rejects rebase commands from GitHub App bot identities. The APP_TOKEN (GitHub App installation token) correctly bypasses the GITHUB_TOKEN recursive-trigger guard so CI fires normally.
- MINOR: Merge-readiness check switched from requiring all status checks to be SUCCESS/NEUTRAL/SKIPPED to trusting GitHub's native 'mergeable' state. This means non-required checks (e.g. gitleaks false positives) no longer block Dependabot auto-merges. If gitleaks or other security scanners are intentionally non-required, this is correct; owners should confirm gitleaks is not a required check in branch protection/rulesets.
- INFO: All CI checks green: CodeQL (actions), SonarCloud (0 new issues, 0 security hotspots), Lint, Format, AgentShield, dependency-audit all pass. No security scanner warnings.
- INFO: APP_ID and APP_PRIVATE_KEY are org secrets forwarded to the reusable workflow — same pattern as before this PR. The reusable workflow uses actions/create-github-app-token (pinned to 1b10c78c) to exchange them for a short-lived APP_TOKEN. No secrets are logged or hardcoded.
Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.
Updates the
dependabot-rebase-reusable.ymlcaller SHA tob51e2ed.Changes in new reusable workflow version:
@dependabot rebasecomments (rejected by Dependabot when posted by a GitHub App bot) toupdate-branchAPI with APP_TOKENmergeablestate instead of checking all check conclusions (avoids blocking on non-required failing checks like gitleaks false positives)Summary by CodeRabbit