fix(ci): deliver the desktop tidy to Dependabot branches - #6976
Conversation
desktop/ is a separate Go module that vendors the root via `replace => ../`,
so a root dependency bump leaves desktop/go.{mod,sum} stale. ci.yaml's
verify-desktop-tidy job computes the fix and uploads it as desktop-tidy.patch,
and desktop.yaml deliberately skips its own hard `go mod tidy -diff` gate on
same-repo PRs on the stated grounds that this self-heal covers them.
Since the PR-branch push started excluding Dependabot, it did not. On a bump the
patch was computed, uploaded and applied — then never committed, while the job
reported success. The bump's own required checks failed on the stale module, so
it could never merge, and the protected-branch path that repairs generated-file
drift only runs after a merge.
That exclusion is right for generated files: schemas and docs are cosmetic drift
the post-merge sync PR fixes, and pushing them costs Dependabot its rebase
ability for the rest of the PR's life. The desktop tidy is a different kind of
patch — a build-blocking prerequisite — so deferring it does not delay a repair,
it prevents one.
Move the exclusion from the commit step into the apply step and scope it to
non-desktop patches. A Dependabot branch now receives the desktop tidy and
nothing else; when desktop is already tidy that patch is empty, nothing is
staged, and the branch is never touched — so Dependabot keeps its rebase ability
in exactly the cases the exclusion was about.
Fixes #6974
✅MegaLinter analysis: Success✅ Linters with no issuesactionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint Notices
See detailed reports in MegaLinter artifacts
|
golangci-lint's varnamelen flags 'ok' where the scope between declaration and last use spans several assertions. Name each result for what it asserts instead of reusing a two-letter identifier across the block.
Requesting a current-head review. CI has fully settled at this head: 72 successful entries and 5 skipped, zero failing — including the Docker system-test matrix that was still in progress when this PR was last handed off. No review has been requested on this PR at any head, so this is the first request rather than a re-request. @coderabbitai full review |
|
✅ Action performedFull review finished. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review. 📜 Recent review details🧰 Additional context used📓 Path-based instructions (4)Use Go 1.26.1 or newer, matching the version declared in `go.mod`.📄 CodeRabbit inference engine (AGENTS.md) Files:
Generated files must not be hand-edited; run `make generate` as the canonical regeneration command.📄 CodeRabbit inference engine (AGENTS.md) Files:
Validate workflow changes with `mega-linter-runner -f go`; MegaLinter runs `actionlint` for GitHub Actions workflows.📄 CodeRabbit inference engine (AGENTS.md) Files:
Add regression tests for confident bug fixes and run flaky-test candidates repeatedly with `go test -run -count=10 ./...`.📄 CodeRabbit inference engine (AGENTS.md) Files:
🔇 Additional comments (2)
📝 WalkthroughWalkthroughThe CI workflow now limits Dependabot pull requests to Priority: ➖ Normal Severity of issue fixed: Medium Merge Risk: ⚪ Minimal · up to Dependabot dependency branches now receive required desktop module tidy updates while generated patches remain excluded, preventing stale desktop dependencies from blocking checks. The change is ready to merge. Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (4 passed)
Full details: Linked Issues checkExplanation The PR addresses Dependabot branch handling for the desktop tidy, but it does not satisfy all linked issue requirements [ Resolution Add or document a deterministic Dependabot configuration or equivalent mechanism that updates both Go modules together. Update TestClaircoreLinkedPackagesStayInert to report go list stderr. Re-run or otherwise update Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Readiness record at 1 — Programmatically tested. 72 successful entries, 5 skipped, 0 failing. I checked that the consuming job actually ran rather than trusting the aggregate: 2 — Reviewed. CodeRabbit full review completed at this head (21:07:24Z, after the 21:01:31Z request; head status 3 — Tried and evaluated as a user. The runtime surface here is CI itself, so I traced the enacting path end to end rather than inferring from the diff:
What I have not yet observed is a real Dependabot run through the repaired job — that is only observable after this merges. #6971/#6972/#6973 are the live cases; I will rerun one immediately after merge and report what it actually did, rather than claim that observation now. Promoting on 1 and 2 plus the traced path, with the post-merge observation stated as outstanding. |
1 participant
Why
Dependency bumps keep stalling. Three are stuck right now (#6971, #6972, #6973), all failing the same four checks for the same reason, and the queue has a cap on how many can be open at once — so stuck ones throttle dependency intake generally.
CI already knows how to fix this and was computing the fix on every one of them, then throwing it away and reporting success.
What
The desktop app is a second Go module that tracks the main one, so a dependency bump has to update it too. CI works that out automatically and is supposed to commit it back to the bump's branch. Since #6851 it stopped doing so on Dependabot's branches — correctly for generated files like schemas and docs, which are tidied up later after the bump merges, and which cost Dependabot its ability to keep a branch up to date if we push them.
The desktop update is not that kind of change: without it the bump's own checks fail, so it can never merge, and "we'll fix it after it merges" never arrives.
Now Dependabot's branch receives the desktop update and nothing else. When the desktop module is already up to date the branch is not touched at all, so #6851's benefit is kept in every case it was actually about.
Fixes #6974
Merge-order note
The three stalled bumps need a rerun (or a rebase) after this lands to pick up the repaired job. They are not fixed by this PR merging on its own.