Add Dependabot, outdated-deps, CodeQL, and scheduled CI issue automation - #51
Merged
Merged
Conversation
Wire weekly Dependabot PRs across npm/Maven/pip/Actions, a scheduled outdated-dependency Issue report, CodeQL analysis with Issue summaries, and daily CI that opens or closes automation Issues based on health. Co-authored-by: Haozheng Li <emiya@emiya.com.cn>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Key the uv cache on pyproject.toml manifests so CI and the outdated-deps workflow no longer fail looking for a missing uv.lock. Co-authored-by: Haozheng Li <emiya@emiya.com.cn>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
There are a couple of automation logic/permissions issues that can lead to incorrect Issue closure and overly broad workflow token permissions.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds GitHub automation to proactively surface dependency drift, security findings (CodeQL), and scheduled CI health failures via standardized “[automation] …” Issues, plus Dependabot configuration for regular upgrade PRs.
Changes:
- Add Dependabot config for npm, Maven, pip (pyproject-based), and GitHub Actions updates.
- Add scheduled workflows to (a) generate an “Outdated dependencies” report Issue and (b) run CodeQL and upsert a summary Issue of open alerts.
- Extend CI with a daily schedule and automation to open/refresh a failure Issue (and close it when green), plus shared helper scripts under
scripts/ci/.
File summaries
| File | Description |
|---|---|
scripts/ci/upsert_automation_issue.sh |
Adds a shared helper to create/update a single automation Issue by exact title match. |
scripts/ci/outdated_deps_report.sh |
Adds a report generator for npm/uv/Maven outdated dependency output in markdown. |
.github/workflows/outdated-deps.yml |
Weekly workflow to generate the outdated deps report and upsert a tracking Issue. |
.github/workflows/codeql.yml |
CodeQL analysis for JS/TS, Python, Java plus a scheduled/manual Issue summarizing open code-scanning alerts. |
.github/workflows/ci.yml |
Adds daily scheduled CI and automation to open/close a scheduled CI failure Issue; adjusts uv cache keying. |
.github/dependabot.yml |
Enables weekly Dependabot PRs across ecosystems with basic grouping/labels. |
Review details
- Files reviewed: 6/6 changed files
- Comments generated: 5
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+79
to
+83
| ALERTS_JSON="$(gh api \ | ||
| -H "Accept: application/vnd.github+json" \ | ||
| "/repos/${GITHUB_REPOSITORY}/code-scanning/alerts?state=open&per_page=100" \ | ||
| || echo '[]')" | ||
|
|
Comment on lines
+176
to
+182
| if: | | ||
| always() && | ||
| github.event_name == 'schedule' && | ||
| needs.backend.result == 'success' && | ||
| needs.backend-java.result == 'success' && | ||
| needs.integration.result == 'success' && | ||
| needs.frontend.result == 'success' |
Comment on lines
+58
to
+60
| cd "$ROOT/backend" | ||
| uv sync --all-extras >/dev/null 2>&1 | ||
| uv pip list --outdated >"$TMP/backend-pip.txt" 2>&1 || true |
Comment on lines
+12
to
+14
| permissions: | ||
| contents: read | ||
| issues: write |
Comment on lines
+13
to
+18
| permissions: | ||
| contents: read | ||
| security-events: write | ||
| issues: write | ||
| actions: read | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds GitHub automation for dependency upgrades and periodic bug discovery, per the 1C + 2C request:
.github/dependabot.yml) — weekly PRs for npm (frontend), Maven (backend-java), pip (backend,integrations/pydantic-ai), and GitHub Actions..github/workflows/outdated-deps.yml) — weekly scan that upserts a single[automation] Outdated dependenciesIssue (npm / uv / Maven)..github/workflows/codeql.yml) — analyzes JS/TS, Python, and Java; on schedule, upserts[automation] CodeQL open alertswhen alerts exist (closes it when clear).[automation] Scheduled CI failure, and a green run closes that Issue.Shared helpers live under
scripts/ci/outdated_deps_report.shandscripts/ci/upsert_automation_issue.sh.Also fixes
astral-sh/setup-uvcaching to key on**/pyproject.tomlbecauseuv.lockis gitignored (this was already failing onmain).Notes
workflow_dispatch-able for manual runs.backend-javatest failures related to multi-tenant auth / duplicateAgentflowPropertiesare pre-existing onmainand are outside this PR’s scope; scheduled CI will correctly open Issues for them until fixed separately.Test plan
backendjob gets pastsetup-uv(no missinguv.lockcache error)workflow_dispatch(or wait for schedule) and confirm failure/success Issue behavior