Skip to content

Commit d21fcf8

Browse files
acosferreiraacosferreira
committed
configure dependabot to open PR and approve the changes
1 parent 34280f5 commit d21fcf8

File tree

6 files changed

+1026
-70
lines changed

6 files changed

+1026
-70
lines changed

‎.github/dependabot.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
version: 2
2+
updates:
3+
# Python dependencies
4+
- package-ecosystem: "pip"
5+
directory: "/"
6+
schedule:
7+
interval: "daily"
8+
target-branch: "ana/aap-52843-mergify"
9+
open-pull-requests-limit: 5
10+
labels:
11+
- "dependencies"
12+
- "python"
13+
commit-message:
14+
prefix: "deps"
15+
include: "scope"
16+
# Ignore major version updates (too risky for auto-merge)
17+
ignore:
18+
- dependency-name: "*"
19+
update-types: ["version-update:semver-major"]
20+
21+
# Admin Portal npm dependencies
22+
- package-ecosystem: "npm"
23+
directory: "/ansible_ai_connect_admin_portal"
24+
schedule:
25+
interval: "daily"
26+
target-branch: "ana/aap-52843-mergify"
27+
open-pull-requests-limit: 5
28+
labels:
29+
- "dependencies"
30+
- "javascript"
31+
- "admin-portal"
32+
commit-message:
33+
prefix: "deps"
34+
include: "scope"
35+
36+
# Chatbot npm dependencies
37+
- package-ecosystem: "npm"
38+
directory: "/ansible_ai_connect_chatbot"
39+
schedule:
40+
interval: "daily"
41+
target-branch: "ana/aap-52843-mergify"
42+
open-pull-requests-limit: 5
43+
labels:
44+
- "dependencies"
45+
- "javascript"
46+
- "chatbot"
47+
commit-message:
48+
prefix: "deps"
49+
include: "scope"
50+
51+
# GitHub Actions
52+
- package-ecosystem: "github-actions"
53+
directory: "/"
54+
schedule:
55+
interval: "daily"
56+
target-branch: "ana/aap-52843-mergify"
57+
open-pull-requests-limit: 5
58+
labels:
59+
- "dependencies"
60+
- "github-actions"
61+
commit-message:
62+
prefix: "ci"

‎.github/mergify.yml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
queue_rules:
2+
- name: ansible-ai-connect-service
3+
queue_conditions:
4+
- author~=^dependabot(|-preview)\[bot\]$
5+
- check-success=Lint
6+
merge_conditions:
7+
- check-success=pre-commit
8+
- check-success=code_coverage
9+
- check-success=selftest
10+
11+
pull_request_rules:
12+
# Auto-approve security updates for Python
13+
- name: Auto-approve Dependabot security updates (Python)
14+
conditions:
15+
- author=dependabot[bot]
16+
- label=security
17+
- label=python
18+
- check-success=pre-commit
19+
- check-success=selftest # pip_compile check
20+
- check-success=pip_audit
21+
- check-success=pyright
22+
- "#changes-requested-reviews-by=0"
23+
- "#review-requested=0"
24+
actions:
25+
review:
26+
type: APPROVE
27+
message: "Dependabot security PR auto-approved. Manual merge required."
28+
29+
# Auto-approve security updates for Admin Portal
30+
- name: Auto-approve Dependabot security updates (Admin Portal)
31+
conditions:
32+
- author=dependabot[bot]
33+
- label=security
34+
- label=admin-portal
35+
- check-success=pre-commit
36+
- check-success=ui_compile
37+
- check-success=npm_audit
38+
- "#changes-requested-reviews-by=0"
39+
- "#review-requested=0"
40+
actions:
41+
review:
42+
type: APPROVE
43+
message: "Dependabot security PR auto-approved. Manual merge required."
44+
45+
# Auto-approve security updates for Chatbot
46+
- name: Auto-approve Dependabot security updates (Chatbot)
47+
conditions:
48+
- author=dependabot[bot]
49+
- label=security
50+
- label=chatbot
51+
- check-success=pre-commit
52+
- check-success=ui_compile_chatbot
53+
- check-success=npm_audit_chatbot
54+
- "#changes-requested-reviews-by=0"
55+
- "#review-requested=0"
56+
actions:
57+
review:
58+
type: APPROVE
59+
message: "Dependabot security PR auto-approved. Manual merge required."
60+
61+
# Auto-approve security updates for GitHub Actions
62+
- name: Auto-approve Dependabot security updates (GitHub Actions)
63+
conditions:
64+
- author=dependabot[bot]
65+
- label=security
66+
- label=github-actions
67+
- check-success=pre-commit
68+
- "#changes-requested-reviews-by=0"
69+
- "#review-requested=0"
70+
actions:
71+
review:
72+
type: APPROVE
73+
message: "Dependabot security PR auto-approved. Manual merge required."
74+
75+
# Auto-approve non-security updates but don't merge
76+
- name: Auto-approve non-security Dependabot PRs
77+
conditions:
78+
- author=dependabot[bot]
79+
- -label=security
80+
actions:
81+
review:
82+
type: APPROVE
83+
message: "Dependabot PR auto-approved. Manual merge required for non-security updates."

‎.github/workflows/dependabot_pip_compile.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Dependabot - Update pip lockfiles
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- 'requirements.in'
7+
- 'requirements-dev.in'
8+
9+
permissions:
10+
contents: write
11+
pull-requests: write
12+
13+
jobs:
14+
update-lockfiles:
15+
if: github.actor == 'dependabot[bot]' && github.head_ref == 'ana/aap-52843-mergify'
16+
runs-on: ubuntu-latest
17+
steps:
18+
- uses: actions/checkout@v3
19+
with:
20+
ref: ${{ github.head_ref }}
21+
token: ${{ secrets.GITHUB_TOKEN }}
22+
23+
- name: Run pip-compile
24+
run: make pip-compile
25+
26+
- name: Commit lockfile changes
27+
run: |
28+
git config user.name "github-actions[bot]"
29+
git config user.email "github-actions[bot]@users.noreply.github.com"
30+
git add requirements*.txt
31+
if git diff --staged --quiet; then
32+
echo "No lockfile changes needed"
33+
else
34+
git commit -m "chore: update pip lockfiles for Dependabot PR"
35+
git push
36+
fi

‎.mergify.yml‎

Lines changed: 0 additions & 70 deletions
This file was deleted.

‎README.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,56 @@ To update the pre-commit config to the latest repos' versions and run the precom
192192
pre-commit autoupdate && pre-commit run -a
193193
```
194194

195+
## Automated Dependency Updates
196+
197+
This project uses Dependabot and Mergify to automatically manage dependencies and security updates.
198+
199+
### How It Works
200+
201+
1. **Dependabot** checks daily for dependency updates across:
202+
- Python packages (requirements.in)
203+
- npm packages (admin portal & chatbot)
204+
- GitHub Actions
205+
206+
2. **Security updates** (CVEs) are automatically merged when:
207+
- All CI/CD tests pass
208+
- No merge conflicts exist
209+
- No change requests from reviewers
210+
211+
3. **Non-security updates** create PRs for manual review
212+
213+
### Managing Dependabot PRs
214+
215+
**To approve a non-security update:**
216+
- Review the PR changes and test results
217+
- Click "Merge pull request" in GitHub UI
218+
219+
**To reject an update:**
220+
- Close the PR with a comment explaining why
221+
- Or add to `.github/dependabot.yml`:
222+
```yaml
223+
ignore:
224+
- dependency-name: "package-name"
225+
versions: ["x.y.z"]
226+
```
227+
228+
**To temporarily pin a version:**
229+
```python
230+
# In requirements.in, add comment:
231+
package-name==1.2.3 # Pinned due to issue #XYZ
232+
```
233+
234+
**To disable auto-merge for a specific PR:**
235+
- Request changes in a review
236+
- OR add label `no-auto-merge` (requires Mergify config update)
237+
238+
### Monitoring
239+
240+
- **Security advisories:** GitHub Security tab
241+
- **Merged updates:** Check commits by `dependabot[bot]`
242+
- **Mergify dashboard:** https://dashboard.mergify.com
243+
- **Metrics:** Monthly report in team meeting
244+
195245
## Updating the Python dependencies
196246

197247
We are now using pip-compile in order to manage our Python

0 commit comments

Comments
 (0)