Skip to content

Fix dependency review workflow for Dependabot PRs #85

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dvasilas merged 6 commits into from
Mar 31, 2026
Merged

Fix dependency review workflow for Dependabot PRs #85

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
92d0612
fix: allow Dependabot as bot actor in dependency review
dvasilas Mar 31, 2026
b937114
fix: add .git suffix to marketplace URL
dvasilas Mar 31, 2026
f2c2953
fix: checkout PR head commit
dvasilas Mar 31, 2026
39c28ea
feat: support private repository dependencies via GitHub App
dvasilas Mar 31, 2026
65ddf5a
feat: Add permissions for CI status verification
dvasilas Mar 31, 2026
9561dbf
fix: add Node.js setup and harden yarn install
dvasilas Mar 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 41 additions & 2 deletions .github/workflows/claude-code-dependency-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,19 @@ on:
CLOUD_ML_REGION:
required: true
description: GCP region for Vertex AI
ACTIONS_APP_PRIVATE_KEY:
required: false
description: Private key for the GitHub App used to access private repositories
Copy link
Copy Markdown
Contributor

@tcarmet tcarmet Mar 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In my example I setted up as a vars you said it worked so great, but double check if it's best to send it as a input

Suggested change
description: Private key for the GitHub App used to access private repositories
description: Private key for the GitHub App used to access private repositories
inputs:
ACTIONS_APP_ID:
required: false
description: <add description>

If thats the case then change the vars.ACTIONS_APP_ID to inputs.ACTIONS_APP_ID

Copy link
Copy Markdown
Contributor Author

@dvasilas dvasilas Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

inputs:
ACTIONS_APP_ID:
required: false
type: string
description: App ID for the GitHub App used to access private repositories
node-version:
required: false
type: string
default: '22'
description: Node.js version to use for dependency installation

jobs:
dependency-review:
Expand All @@ -24,17 +37,42 @@ jobs:
contents: read
pull-requests: write
id-token: write
checks: read
actions: read
Copy link
Copy Markdown

@claude claude bot Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The added checks: read and actions: read permissions aren't used by any of the new steps in this PR (token generation, git config, Node.js setup). If claude-code-action requires them, consider adding a YAML comment explaining why — otherwise remove them to keep least-privilege.

— Claude Code


steps:
- uses: actions/checkout@v6
with:
ref: ${{ github.event.pull_request.head.sha }}
Copy link
Copy Markdown

@claude claude bot Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security note: This workflow is called via workflow_call, so the trigger depends on the caller. If the caller uses pull_request_target, checking out github.event.pull_request.head.sha means untrusted PR code is checked out in a context with write permissions (pull-requests: write).

The risk is mitigated here because:
- yarn install uses --ignore-scripts
- No run: steps execute code from the checked-out repo
- claude-code-action reads but doesn't execute repo files

Consider adding a comment in the workflow noting this security trade-off, so future contributors don't add run: steps that source repo files after checkout.

— Claude Code

fetch-depth: 1

- name: Generate token for private repositories
if: inputs.ACTIONS_APP_ID != ''
uses: actions/create-github-app-token@v1
id: app-token
with:
app-id: ${{ inputs.ACTIONS_APP_ID }}
private-key: ${{ secrets.ACTIONS_APP_PRIVATE_KEY }}
owner: ${{ github.repository_owner }}

- name: Configure git for private repositories
if: steps.app-token.outputs.token != ''
run: |
git config --global url."https://x-access-token:${GIT_ACCESS_TOKEN}@github.com/".insteadOf "https://github.com/"
env:
GIT_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}

- name: Set up Node.js
if: hashFiles('yarn.lock') != ''
uses: actions/setup-node@v4
with:
node-version: ${{ inputs.node-version }}

- name: Install dependencies
id: install-deps
if: hashFiles('yarn.lock') != ''
continue-on-error: true
run: yarn install --frozen-lockfile
run: yarn install --frozen-lockfile --ignore-scripts

- name: Warn on failed dependency install
if: steps.install-deps.outcome == 'failure'
Expand All @@ -53,7 +91,8 @@ jobs:
with:
github_token: ${{ github.token }}
use_vertex: "true"
plugin_marketplaces: https://github.com/scality/agent-hub
allowed_bots: "dependabot[bot]"
plugin_marketplaces: https://github.com/scality/agent-hub.git
plugins: scality-skills@scality-agent-hub
prompt: "/review-dependency-bump REPO: ${{ github.repository }} PR_NUMBER: ${{ github.event.pull_request.number }}"
claude_args: |
Expand Down
Loading