[Fleet Monitor] petry-projects/TalkTerm — .github/workflows/dependabot-rebase.yml

[don-petry]

🟡 WARNING: petry-projects/TalkTerm / .github/workflows/dependabot-rebase.yml

Metric	Value
Failure Rate	16.7% (1 / 6 runs)
Status	WARNING
p50 Duration	17s
p95 Duration	18s
Successful Runs	5
Cancelled Runs	0

Workflow: .github/workflows/dependabot-rebase.yml

Last updated by Fleet Monitor run on 2026-08-12.
Threshold: failure rate > 10% over the monitored window.

[don-petry]

Dev-Lead Implementation Plan

Issue: #428 — [Fleet Monitor] petry-projects/TalkTerm — .github/workflows/dependabot-rebase.yml

Root-cause analysis

The single failing run (of 6) — run 31515783532 — failed inside the reusable workflow's Update and merge Dependabot PRs step with:

PR #419 (...) is up to date — checking if merge-ready
Post "https://api.github.com/graphql": tls: failed to verify certificate:
  x509: certificate is not valid for any names, but wanted to match api.github.com
##[error]Process completed with exit code 1.

This is a transient GitHub-API TLS certificate error — infrastructure flakiness, not a defect in TalkTerm. It tipped the failure rate to 16.7% (1/6), just over the 10% threshold. The other 5 runs succeeded.

Scope

Two constraints shape the fix:

1. dependabot-rebase.yml is a frozen thin caller stub. Its header forbids changing the uses: ref, concurrency group, secrets block, permissions block, or triggers — and none of those cause the TLS flake anyway.
2. The transient-retry hardening (retry/backoff around gh API calls under bash -e) belongs in the org-level reusable dependabot-rebase-reusable.yml in petry-projects/.github, which this repo cannot modify.

So no caller-side change can prevent the observed transient failure. What this repo can do — matching its established Fleet Monitor response convention (scripts/test-pr-review-workflow.sh for #374, scripts/test-ci-workflow.sh for #380) — is add a regression-guard test that locks in the reliability-critical invariants the stub's own header says MUST NOT drift. Their loss would cause real, non-transient 100% failures (e.g. dropping the permissions block breaks every reusable gh call; repointing the uses: ref off the channel; dropping the App secrets breaks token generation).

Implementation Checklist

• Add scripts/test-dependabot-rebase-workflow.sh — regression guard mirroring the sibling test-*-workflow.sh convention (yq-based, set -euo pipefail)

Tests to Write (the deliverable is a test)

• Guard asserts: file exists & valid YAML
• Guard asserts: job uses: is the org reusable pinned to the dependabot-rebase/ channel (rejects @main, a bare SHA, or a frozen @vN)
• Guard asserts: job permissions: grants contents: write and pull-requests: write
• Guard asserts: secrets: passes APP_ID and APP_PRIVATE_KEY
• Guard asserts: concurrency.group: dependabot-update-and-merge with cancel-in-progress: false
• Guard asserts: all three triggers present (push→main, schedule, workflow_dispatch)
• Verify guard fails (red) on a deliberately mutated fixture, passes (green) on the real file

Test Command

bash scripts/test-dependabot-rebase-workflow.sh (+ bash .dev-lead/scripts/dev-lead-lint.sh for shellcheck)

Note

The observed failure is transient GitHub infrastructure; I am not fabricating a caller-side "fix" for it. The recommended durable fix — retry/backoff on transient gh errors — should be raised against the reusable in petry-projects/.github. This guard hardens against the configuration-drift failure class, per repo convention.

[don-petry]

Dev-Lead: Implementation Complete

Root cause (confirmed)

The one failing run of six — run 31515783532 — died inside the reusable workflow's Update and merge Dependabot PRs step on a transient GitHub-API TLS certificate error:

PR #419 (...) is up to date — checking if merge-ready
Post "https://api.github.com/graphql": tls: failed to verify certificate:
  x509: certificate is not valid for any names, but wanted to match api.github.com
##[error]Process completed with exit code 1.

This is GitHub infrastructure flakiness (a bad TLS cert served by api.github.com), not a TalkTerm defect. Under bash -e, the failed gh call in a command substitution crashed the step. It tipped the rate to 16.7% (1/6); the other 5 runs succeeded.

Why no caller-side "fix" for the flake

• dependabot-rebase.yml is a frozen thin caller stub; its header forbids changing the uses: ref, concurrency, secrets, permissions, or triggers — none of which cause the TLS flake.
• The durable fix (retry/backoff on transient gh errors) belongs in the org reusable dependabot-rebase-reusable.yml in petry-projects/.github, outside this repo. Recommend raising that upstream.
• Fabricating a caller change would not reduce the failure rate and would violate the stub's constraints.

What this repo can do (per Fleet Monitor convention)

Following the established pattern (test-pr-review-workflow.sh #374, test-ci-workflow.sh #380), I added a regression guard that locks in the stub's MUST-NOT-CHANGE invariants — whose drift would cause real, non-transient 100% failures.

Plan Execution

• Confirmed root cause from the failing run log
• Added scripts/test-dependabot-rebase-workflow.sh regression guard
• Validated guard: green on real file, red on 5 mutations (uses@main, dropped contents perm, dropped APP_PRIVATE_KEY, cancel-in-progress:true, dropped schedule trigger)
• dev-lead lint (shellcheck) + all sibling guards pass

Test Results

=== test-dependabot-rebase-workflow (.github/workflows/dependabot-rebase.yml) ===
PASS: 'yq' is available
PASS: .github/workflows/dependabot-rebase.yml exists
PASS: .github/workflows/dependabot-rebase.yml is valid YAML
PASS: job 'uses' rides the dependabot-rebase channel
PASS: job permission 'contents: write' present
PASS: job permission 'pull-requests: write' present
PASS: secret 'APP_ID' is passed to the reusable
PASS: secret 'APP_PRIVATE_KEY' is passed to the reusable
PASS: concurrency.group is 'dependabot-update-and-merge'
PASS: concurrency.cancel-in-progress is 'false'
PASS: trigger 'push' present
PASS: trigger 'schedule' present
PASS: trigger 'workflow_dispatch' present
PASS: 'push' trigger includes 'main'

All checks passed.

dev-lead-lint: all checks passed
shellcheck scripts/test-dependabot-rebase-workflow.sh: OK
all scripts/test-*-workflow.sh: All checks passed (4/4)

Files Changed

• scripts/test-dependabot-rebase-workflow.sh (new): yq-based guard asserting the reusable uses: channel pin, job contents:write/pull-requests:write permissions, APP_ID/APP_PRIVATE_KEY secrets pass-through, concurrency serialization (dependabot-update-and-merge, cancel-in-progress:false), and all three triggers (push→main, schedule, workflow_dispatch).

Notes

• The observed failure is transient GitHub infrastructure; the guard hardens against the configuration-drift failure class, not the flake. Follow-up: open a PR against dependabot-rebase-reusable.yml in petry-projects/.github to retry transient gh API errors.
• No application/source files exist in this checkout (workflow-automation template repo); the repo's test convention is the bash scripts/test-*-workflow.sh guards, so no npm test was applicable.

[don-petry]

✅ Auto-resolved by Fleet Monitor. This workflow's failure rate has been below the 10% threshold (or the workflow was removed) since 2026-08-12 (3 days) — the monitor stopped flagging it. Closing. It will reopen automatically if the workflow crosses the threshold again.