ci: leave Dependabot branches to Dependabot so bumps can rebase themselves by devantler · Pull Request #6851 · devantler-tech/ksail

devantler · 2026-09-03T06:13:33Z

🤖 Generated by the Agentic Engineer

Motivation

Dependency bumps keep getting stuck and needing a person to nudge them. GitHub takes
Dependabot's rebase ability away permanently as soon as anything else pushes to its
branch — and our CI was pushing a generated-file sync onto those branches. About half
of all Dependabot PRs were affected: as soon as any other PR merged, they fell behind,
auto-merge could never fire, and the usual "rebase this" remedy was refused. Because
the dependency queue has a cap on how many PRs can be open at once, the stuck ones sat
in that cap and throttled dependency intake generally.

Three PRs are stranded by this right now (#6839, #6845, #6826).

Change

CI no longer pushes the generated-file sync onto Dependabot's own branches, so
Dependabot keeps ownership and can rebase itself. The generated changes are not lost —
they land through the path we already have, which opens a sync PR once the bump has
merged.

Picks option 1 of the three the issue put forward. It is the only one that removes the
cause rather than reducing how often it bites, and the machinery it depends on already
exists.

Fixes #6832

…elves The auto-commit job pushed its generated-file sync onto every same-repo PR branch, Dependabot's included. GitHub permanently revokes Dependabot's ability to rebase a pull request once another actor pushes to its branch, so a synced bump could never recover from base drift: the moment anything else merged it went behind base, auto-merge could never fire, and `@dependabot rebase` was refused. Roughly half of Dependabot PRs carried the sync commit, and because the ecosystem is capped at an open-PR limit the stranded ones throttled dependency intake generally. Skip the PR-branch push for Dependabot-authored pull requests. The generated change is not lost: it lands through the existing protected-branch path, which opens a sync PR after the bump merges to the default branch. Both drift gates that could otherwise fail such a PR are fork-only, so nothing goes red in the gap. The contract test asserts both conditions whole rather than by substring, for the reason the concurrency tests in the same file record: a fragment match admits inverted and appended forms that still push to Dependabot's branch. Fixes #6832 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

github-actions · 2026-09-03T06:15:49Z

✅MegaLinter analysis: Success

✅ Linters with no issues

actionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_GITLEAKS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

devantler · 2026-09-03T06:16:05Z

🤖 Generated by the Agentic Engineer

What I exercised (readiness record — NOT yet met)

RED/GREEN. The contract test fails on main for exactly the intended reason —
github.event_name == 'pull_request' vs the expected condition — and the
protected-branch assertion passed in the same RED run, so the failure isolates the one
thing this change alters. Green after the fix, with the whole internal/ciharness
suite (-count=1, which is load-bearing here: the subject is a YAML file the Go build
graph cannot see).

The discriminator actually discriminates. The condition is a no-op unless the login
spelling is exact, so I read it off the live payload rather than assuming:
user.login is dependabot[bot] on all three stranded PRs (#6839, #6845, #6826), and
the controls differ — ksail-bot[bot] (#6849) and devantler (#6850). So the step
skips for Dependabot and still runs for everyone else.

actionlint introduces no new finding. Control on the pristine main file and on
this one both exit 1 with the same single pre-existing finding (the unknown
code-quality permission scope at line 437, unrelated to this change); the finding
lists are byte-identical.

The fallback path is real, not assumed. The generated change is only "not lost" if
the protected-branch path actually runs: ci.yaml triggers on push: branches: [main],
and that path has genuinely produced a PR before — #4490 on
chore/sync-generated-files/main. Both drift gates that could otherwise fail a
Dependabot PR in the gap (generated files, desktop tidy) are fork-only, so nothing
goes red while the sync is pending.

What is NOT yet proven

The third acceptance criterion on #6832 — "a PR is observed going stale and then
reaching merge with no agent intervention" — cannot be satisfied before this merges.
It needs a real Dependabot bump to go stale and recover on its own. This should sit in
📊 Verifying after merge until that is observed, not be treated as done at merge.

One honest caveat on the fallback: #4490 is the only historical instance I found and it
closed unmerged, with no comment saying why. That is consistent with the drift being
resolved by a later commit (create-pull-request closes a PR whose diff goes empty),
but I did not confirm it, so the post-merge check should also confirm the sync PR
actually lands.

Staying a draft until CI is green and a review lane has returned a green at this head.

…flow golangci-lint's --fix pass removes this //nolint as unused, which fails the lint job under signed-fix-commits-disabled. autoCommitWorkflow only carries `jobs` and `steps` tags, so tagliatelle never fires on it. concurrencyWorkflow's directive is kept: that struct carries a genuinely kebab-case `cancel-in-progress` tag, so its suppression is live. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

devantler · 2026-09-03T09:05:23Z

🤖 Generated by the Agentic Engineer

CI is fully settled green (67 pass, 8 skipped, 0 fail) and the branch is CLEAN against base. Opening the review lane.

@coderabbitai review

coderabbitai · 2026-09-03T09:05:43Z

@devantler Review started for PR #6851 at the requested head commit.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai · 2026-09-03T09:05:49Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Team

Run ID: a50019af-3961-481a-bb30-d4e4288e7fdb

📥 Commits

Reviewing files that changed from the base of the PR and between 71f35b7 and af3f8af.

📒 Files selected for processing (2)

.github/workflows/ci.yaml
internal/ciharness/ci_workflow_test.go

Included review availability: Your plan provides up to 2 included reviews per hour; 0 remain after this review.

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (4)

Use Go 1.26.1 or newer, matching the version declared in `go.mod`.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

internal/ciharness/ci_workflow_test.go

Generated files must not be hand-edited; run `make generate` as the canonical regeneration command.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

internal/ciharness/ci_workflow_test.go

Validate workflow changes with `mega-linter-runner -f go`; MegaLinter runs `actionlint` for GitHub Actions workflows.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

.github/workflows/ci.yaml

Add regression tests for confident bug fixes and run flaky-test candidates repeatedly with `go test -run -count=10 ./...`.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

internal/ciharness/ci_workflow_test.go

🔇 Additional comments (2)

.github/workflows/ci.yaml (1)

763-765: LGTM!

internal/ciharness/ci_workflow_test.go (1)

311-330: LGTM!

Also applies to: 332-353

📝 Walkthrough

Walkthrough

The CI workflow now prevents the PR-branch auto-commit step from running for Dependabot-authored pull requests. New test coverage parses the workflow, validates the auto-commit job and named steps, and checks the exact conditions for PR-branch pushes and protected-branch synchronization.

Merge Risk: ⚪ Minimal · up to af3f8

This change prevents generated-file commits from being pushed to Dependabot branches while preserving the protected-branch synchronization path. No current actionable merge risk remains.

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 1 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.
Linked Issues check	❓ Inconclusive	The workflow change addresses the coding objective in `#6832` by preventing generated-file sync commits on Dependabot branches. The provided context does not confirm the required real-world recovery of …	Verify a real Dependabot PR after base-branch drift. Confirm that it recovers and merges without agent intervention, and confirm that generated files become correct on main after the merge.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The workflow change and the added CI contract test directly support the Dependabot branch-ownership objective in `#6832`. No unrelated code changes are identified.
Title check	✅ Passed	The title clearly and concisely describes the main CI change: Dependabot branches no longer receive generated-file commits, which preserves Dependabot rebase support.
Description check	✅ Passed	The description directly explains the Dependabot rebase problem, the CI change, the fallback synchronization path, and the linked issue.

Full details: Linked Issues check

Explanation

The workflow change addresses the coding objective in #6832 by preventing generated-file sync commits on Dependabot branches. The provided context does not confirm the required real-world recovery of a stale Dependabot PR or post-merge generated-file synchronization.

Full details: Docstring Coverage

Explanation

Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 1 files. (1 skipped: 1 unsupported.)

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

devantler · 2026-09-03T09:21:12Z

🤖 Generated by the Agentic Engineer

The earlier request hit the OSS review limit, which named a 7-minute reset; that window has elapsed, so re-requesting rather than spending a metered lane on a head the free lane can take.

@coderabbitai review

coderabbitai · 2026-09-03T09:21:21Z

Your plan includes PR reviews subject to rate limits. Reviews are available now.

devantler · 2026-09-03T09:36:12Z

🤖 Generated by the Agentic Engineer

The previous trigger drew only the rate-limit notice (which then reported the limit lifted) and no review followed in ~20 minutes, so that request was absorbed rather than queued. Re-requesting as a full review to also clear any incremental wedge.

@coderabbitai full review

coderabbitai · 2026-09-03T09:36:26Z

@devantler Full review requested for the current PR head.

✅ Action performed

Full review finished.

devantler · 2026-09-03T09:44:54Z

🤖 Generated by the Agentic Engineer

Readiness — all three conditions met at `af3f8af3`

1. Programmatically tested. 67 successful checks, 0 failing, mergeStateStatus: CLEAN. The new ci_workflow_test.go case parses the real ci.yaml and asserts the exact if: on both auto-commit delivery paths — so this is pinned against the shipped workflow rather than a copy, and it also asserts the protected-branch path still exists, which is where a skipped Dependabot sync has to land instead.

2. Reviewed. CodeRabbit full review completed at this head (09:39:37Z): "No actionable comments were generated in the recent review", status Review completed, summary naming af3f8af37d11c2f847c467a8ce1ccce8411bd314, no rate-limit marker, 0 review threads. The only collapsed section is 🔇 Additional comments (2), which is informational.

3. Tried and evaluated as a user — one half observed, one half deferred, stated plainly.

The change narrows when CI pushes a generated-file commit onto a PR's own branch. It has two observable halves and I can only exercise one from here:

Observed now: the normal path must keep working, and it does. On this PR's own CI - KSail run (33726522507, at exactly af3f8af3), the job 📤 Auto-Commit Generated Changes ran and its step 📤 Commit and push generated changes (PR branch) completed success. This PR is not Dependabot-authored, so the added clause must not suppress it — and it did not. That is the regression this change could most easily have caused, and it is ruled out by observation rather than by reading the condition.
Deferred to post-merge: the step must skip on a Dependabot-authored PR. I cannot author one, so that half is asserted by the test above against the real workflow and confirmed behaviourally on the next Dependabot PR.

The problem it fixes is already visible: #6845, #6826 and #6839 have all been disowned by Dependabot ("can't rebase it") after CI pushed to their branches, which is exactly what this suppresses.

Promoting and merging; the Dependabot-side confirmation is a post-merge verification, not a claim being made now.

github-project-automation Bot added this to 🌊 Project Board Sep 3, 2026

github-project-automation Bot moved this to 🫴 Ready in 🌊 Project Board Sep 3, 2026

This was referenced Sep 3, 2026

chore(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.22.0 #6839

Merged

chore(deps): bump github.com/siderolabs/image-factory from 1.3.3 to 1.5.1 #6845

Open

chore(deps): bump the talos group across 1 directory with 3 updates #6826

Open

devantler marked this pull request as ready for review September 3, 2026 09:44

devantler merged commit 9e14ea5 into main Sep 3, 2026
76 checks passed

devantler deleted the claude/dependabot-branch-ownership-6832 branch September 3, 2026 09:45

github-project-automation Bot moved this from 🫴 Ready to ✅ Done in 🌊 Project Board Sep 3, 2026

Navigation Menu

Uh oh!

Uh oh!

ci: leave Dependabot branches to Dependabot so bumps can rebase themselves - #6851

ci: leave Dependabot branches to Dependabot so bumps can rebase themselves#6851
devantler merged 2 commits into
mainfrom
claude/dependabot-branch-ownership-6832

devantler commented Sep 3, 2026

Uh oh!

github-actions Bot commented Sep 3, 2026 •

edited

Loading

Uh oh!

devantler commented Sep 3, 2026

Uh oh!

devantler commented Sep 3, 2026

Uh oh!

coderabbitai Bot commented Sep 3, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 3, 2026 •

edited

Loading

Walkthrough

Pre-merge checks failed

Uh oh!

devantler commented Sep 3, 2026

Uh oh!

coderabbitai Bot commented Sep 3, 2026

Uh oh!

devantler commented Sep 3, 2026

Uh oh!

coderabbitai Bot commented Sep 3, 2026 •

edited

Loading

Uh oh!

devantler commented Sep 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

devantler commented Sep 3, 2026

Motivation

Change

Uh oh!

github-actions Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅MegaLinter analysis: Success

✅ Linters with no issues

Notices

Uh oh!

devantler commented Sep 3, 2026

What I exercised (readiness record — NOT yet met)

What is NOT yet proven

Uh oh!

devantler commented Sep 3, 2026

Uh oh!

coderabbitai Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Pre-merge checks failed

❌ Failed checks (1 warning, 1 inconclusive)

Uh oh!

devantler commented Sep 3, 2026

Uh oh!

coderabbitai Bot commented Sep 3, 2026

Uh oh!

devantler commented Sep 3, 2026

Uh oh!

coderabbitai Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devantler commented Sep 3, 2026

Readiness — all three conditions met at af3f8af3

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented Sep 3, 2026 •

edited

Loading

coderabbitai Bot commented Sep 3, 2026 •

edited

Loading

coderabbitai Bot commented Sep 3, 2026 •

edited

Loading

coderabbitai Bot commented Sep 3, 2026 •

edited

Loading

Readiness — all three conditions met at `af3f8af3`