Skip templated dependency audit on Dependabot PRs - #23
Conversation
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🔗 Linked repositories identifiedCodeRabbit considers these linked repositories for cross-repo context during reviews:
Summary
WalkthroughThis PR adds a weekly or manually triggered dependency-audit workflow with optional Rust tooling, skips the existing CI audit for Dependabot-triggered runs, and updates generated-workflow tests plus developer and user documentation. ChangesDependency audit workflow changes
Sequence Diagram(s)sequenceDiagram
participant Scheduler as GitHub Actions Scheduler
participant AuditWorkflow as Audit Workflow
participant Runner as ubuntu-latest Runner
Scheduler->>AuditWorkflow: weekly cron trigger or workflow_dispatch
AuditWorkflow->>Runner: checkout, setup Python 3.13, install uv
alt use_rust enabled
AuditWorkflow->>Runner: setup Rust and install cargo-audit
end
AuditWorkflow->>Runner: run make audit
Possibly related PRs
Poem
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (2 inconclusive)
✅ Passed checks (18 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
@coderabbitai resume |
✅ Action performedReviews resumed. |
`make audit` reports advisories against the whole lockfile, so in generated projects a newly published advisory fails every open Dependabot PR regardless of its content and deadlocks auto-merge. Condition the audit step on the actor not being Dependabot, and add a templated weekly scheduled audit workflow as the compensating control so anything that slips through surfaces within days. Human pull requests keep the full audit gate.
Add a timeout to the scheduled audit job and assert the CI audit step's Dependabot guard structurally. Cover the generated scheduled audit workflow for both pure-Python and Rust-enabled renders so its trigger, permissions, timeout, and Rust-specific steps stay under test.
Explain that pull-request CI skips dependency auditing for Dependabot and that the weekly scheduled workflow audits the default branch as the compensating control.
eafa5a4 to
fc34b45
Compare
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
This comment was marked as resolved.
Document the Dependabot exception in the parent CI strategy and assert the scheduled audit workflow's manual trigger and exact audit command.
|
@coderabbitai Have the following now been resolved? template/.github/workflows/audit.yml.jinja (1)
🤖 Detailed instructionsVerify each finding against current code. Fix only still-valid issues, skip the In |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== PR changes relevant to the finding =='
git diff --unified=80 origin/main...HEAD -- \
template/.github/workflows/audit.yml.jinja \
tests/test_audit.py
echo
echo '== Workflow template =='
cat -n template/.github/workflows/audit.yml.jinja
echo
echo '== Test module outline =='
ast-grep outline tests/test_audit.py --items all --type function --match 'audit|workflow|render'
echo
echo '== Focused audit-workflow test and helpers =='
rg -n -C 12 \
'test_generated_audit_workflow_has_expected_contract|audit\.yml|use_rust|workflow_dispatch|cron|permissions|timeout-minutes|Rust' \
tests/test_audit.py tests || true
echo
echo '== Current changed-file status =='
git diff --name-status origin/main...HEADLength of output: 1181 🏁 Script executed: #!/bin/bash
set -uo pipefail
echo '== Repository and PR refs =='
git status --short --branch || true
git branch -a --no-color || true
gh pr view 23 --repo leynos/agent-template-python \
--json headRefName,baseRefName,files,url 2>/dev/null || true
echo
echo '== Candidate files =='
fd -a -H -t f -E .git \
'^(audit\.yml\.jinja|test_audit\.py)$' . || true
echo
echo '== Workflow template =='
cat -n template/.github/workflows/audit.yml.jinja 2>/dev/null || true
echo
echo '== Test module structure =='
ast-grep outline tests/test_audit.py --items all --type function 2>/dev/null || true
echo
echo '== Focused contract and render helper references =='
rg -n -C 15 \
'generated_audit_workflow|audit\.yml|use_rust|workflow_dispatch|cron|permissions|timeout-minutes|cargo-audit|make audit' \
tests/test_audit.py tests/helpers 2>/dev/null || trueLength of output: 75270
These checks directly cover the Jinja conditionals in |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== PR metadata and changed files =='
gh pr view 23 --repo leynos/agent-template-python --json baseRefName,headRefName,url,files
git diff --name-status origin/main...HEAD
echo
echo '== Relevant current files =='
for file in \
template/.github/workflows/ci.yml.jinja \
template/.github/workflows/audit.yml.jinja \
tests/test_audit.py \
tests/helpers/ci_contracts.py \
template/docs/users-guide.md.jinja \
template/docs/developers-guide.md \
docs/developers-guide.md
do
echo "--- ${file}"
cat -n "${file}"
done
echo
echo '== Focused diff =='
git diff --unified=8 origin/main...HEAD -- \
template/.github/workflows/ci.yml.jinja \
template/.github/workflows/audit.yml.jinja \
tests/test_audit.py \
tests/helpers/ci_contracts.py \
template/docs/users-guide.md.jinja \
template/docs/developers-guide.md \
docs/developers-guide.mdLength of output: 2133 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Relevant current files =='
for file in \
template/.github/workflows/ci.yml.jinja \
template/.github/workflows/audit.yml.jinja \
tests/test_audit.py \
tests/helpers/ci_contracts.py \
template/docs/users-guide.md.jinja \
template/docs/developers-guide.md \
docs/developers-guide.md
do
echo "--- ${file}"
cat -n "${file}"
done
echo
echo '== PR patch from GitHub =='
gh pr diff 23 --repo leynos/agent-template-python --patchLength of output: 71136
Run the PR CI to confirm runtime execution of the focused tests; static inspection confirms the required tests and documentation are present and cover the reported regressions. |
|
@coderabbitai review |
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/test_audit.py`:
- Around line 160-169: Update the Rust workflow assertions in the use_rust
branch to locate the step named “Install cargo-audit” and assert its run value
is exactly “cargo install --locked cargo-audit”; retain the existing setup-step
presence and pure-Python exclusion checks.
- Around line 108-115: Update the
test_generated_audit_workflow_has_expected_contract signature to insert a
keyword-only separator before use_rust, preserving pytest’s named
parametrization binding while resolving Ruff’s FBT001 warning.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 5d2ce200-92dc-450e-b2a7-196a966ee246
📒 Files selected for processing (7)
docs/developers-guide.mdtemplate/.github/workflows/audit.yml.jinjatemplate/.github/workflows/ci.yml.jinjatemplate/docs/developers-guide.mdtemplate/docs/users-guide.md.jinjatests/helpers/ci_contracts.pytests/test_audit.py
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
leynos/whitaker(auto-detected)leynos/cuprum(auto-detected)leynos/mdtablefix(auto-detected)
Assert the exact `cargo install --locked cargo-audit` run value for the generated "Install cargo-audit" step instead of only checking the step's presence, so a regression in the install command is caught. Make `use_rust` keyword-only in the contract test signature to keep the boolean parameter off the positional interface (Ruff FBT001) while preserving pytest's name-based parametrization binding. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This comment was marked as resolved.
This comment was marked as resolved.
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== PR metadata and relevant changed files =='
gh pr view 23 --repo leynos/agent-template-python --json headRefName,baseRefName,url,files
git diff --name-status origin/main...HEAD -- \
template/.github/workflows/audit.yml.jinja \
tests/test_audit.py
echo
echo '== Workflow template =='
cat -n template/.github/workflows/audit.yml.jinja
echo
echo '== Audit workflow contract test =='
ast-grep outline tests/test_audit.py --items all --type function --match 'test_generated_audit_workflow_has_expected_contract'
rg -n -C 18 \
'test_generated_audit_workflow_has_expected_contract|Install cargo-audit|cargo install --locked cargo-audit|RUSTFLAGS|Audit dependencies' \
tests/test_audit.py
echo
echo '== Exact focused PR diff =='
git diff --unified=20 origin/main...HEAD -- \
template/.github/workflows/audit.yml.jinja \
tests/test_audit.pyLength of output: 2134 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Workflow template =='
cat -n template/.github/workflows/audit.yml.jinja
echo
echo '== Contract test structure and relevant assertions =='
ast-grep outline tests/test_audit.py --items all --type function --match 'test_generated_audit_workflow_has_expected_contract'
rg -n -C 24 \
'test_generated_audit_workflow_has_expected_contract|Install cargo-audit|cargo install --locked cargo-audit|RUSTFLAGS|Audit dependencies' \
tests/test_audit.py
echo
echo '== PR patch restricted to the two relevant files =='
gh api \
repos/leynos/agent-template-python/pulls/23/files \
--paginate \
--jq '.[] | select(.filename == "template/.github/workflows/audit.yml.jinja" or .filename == "tests/test_audit.py") | "FILE: \(.filename)\n\(.patch // "(no textual patch returned)")\n"'Length of output: 13351
This fails if |
|
@coderabbitai review |
✅ Action performedReview finished.
|
2 participants
Summary
make auditstep ongithub.actor != 'dependabot[bot]'. (Thecargo-auditinstall stays unconditional because it is bundled with the Whitaker lint tooling install, which the lint step also needs.)audit.yml.jinja) as the compensating control, covering both theuse_rustand plain-Python renders and reusing the template's existing pinned action refs.Motivation
make auditreports advisories against the whole lockfile, so in generated projects a newly published advisory fails every open Dependabot PR regardless of its content, deadlocking Dependabot auto-merge (observed on leynos/corbusier#120, where even Dependabot's own fix for a vite advisory was blocked by unrelated advisories). The same change has been applied directly to the twelve existing estate repositories withmake auditgates; this PR brings the template in line so newly generated projects inherit it. Human pull requests keep the full audit gate.Test plan
use_rust=Trueanduse_rust=False(StrictUndefined) and validated withactionlintact-validationtemplate render passes in CIReferences