Implement split fetch/update phases with separate containers and proxies

[v-robaiken]

No description provided.

[Copilot]

Pull request overview

Adds an experimental two-container Dependabot workflow separating fetch and update phases with isolated proxies and credentials.

Changes:

• Adds split-phase orchestration and file handoff.
• Namespaces proxy networks and adjusts container environments per phase.
• Adds unit/integration coverage, though end-to-end split execution remains skipped.

Show a summary per file

File	Description
src/updater.ts	Orchestrates split phases and credential filtering.
src/updater-builder.ts	Configures phase-specific container environments.
src/proxy.ts	Namespaces proxies and networks by phase.
src/container-service.ts	Runs phase-specific updater commands and reads artifacts.
dist/main/index.js	Updates the bundled action.
__tests__/updater.test.ts	Tests split orchestration and handoff.
__tests__/updater-integration.test.ts	Adds skipped split-phase integration coverage.
__tests__/updater-builder.test.ts	Tests phase-specific environment variables.
__tests__/proxy-integration.test.ts	Tests proxy/network isolation.
__tests__/container-service.test.ts	Tests phase command selection.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 9/11 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

Review details

Suppressed comments (1)

src/updater.ts:192

• This classifies every host-scoped git_source credential (one without repo) as a target-repository credential, even when its host is GitLab, Bitbucket, or another GitHub server. Such credentials may be required for private git dependencies, but they are removed from the update proxy, causing those updates to fail. Match the credential host against the target repository’s GitHub server host before applying the repository-scope check.

    // A git_source credential scoped to a different repository does not resolve
    // to the target repo, so it is kept for git-sourced dependencies.
    if (credential.repo && targetRepo && credential.repo !== targetRepo) {
      return false

• Files reviewed: 9/11 changed files
• Comments generated: 0 new
• Review effort level: Balanced