ROSA-745: per-repo dependency automation config#917
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@MitaliBhalla: This pull request references ROSA-745 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the initiative to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
WalkthroughThe Dependabot configuration for Go modules was updated to reduce update frequency from daily to weekly. Additional configuration fields for open pull request limits and dependency grouping patterns for AWS SDK, Kubernetes, and OpenShift packages were added to the ChangesDependabot Configuration Update
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
Skipping CI for Draft Pull Request. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: MitaliBhalla The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/dependabot.yml:
- Around line 8-24: The dependabot config's allow list currently limits updates
to only the two OpenShift packages, making the "aws-sdk" and "kubernetes" groups
unreachable; fix by either removing the top-level allow block (so groups
aws-sdk, kubernetes, openshift are evaluated), or if you want to keep allow,
remove the unused "aws-sdk" and "kubernetes" group entries, or expand the allow
list to include the specific AWS and Kubernetes dependencies you want Dependabot
to update (update the "allow" entries or adjust "groups" patterns accordingly).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 65a235ff-960e-4fe1-b170-47c04dfde7bf
📒 Files selected for processing (1)
.github/dependabot.yml
| allow: | ||
| - dependency-name: "github.com/openshift/osd-network-verifier" | ||
| - dependency-name: "github.com/openshift/backplane-cli" | ||
| schedule: | ||
| interval: 'daily' | ||
| interval: 'weekly' | ||
| open-pull-requests-limit: 10 | ||
| groups: | ||
| aws-sdk: | ||
| patterns: | ||
| - "github.com/aws/aws-sdk-go-v2*" | ||
| kubernetes: | ||
| patterns: | ||
| - "k8s.io/*" | ||
| - "sigs.k8s.io/*" | ||
| openshift: | ||
| patterns: | ||
| - "github.com/openshift/*" |
There was a problem hiding this comment.
The allow list conflicts with the groups configuration—aws-sdk and kubernetes groups are unreachable.
Dependabot's allow field restricts updates to only the listed dependencies. Currently, only two OpenShift packages are allowed:
github.com/openshift/osd-network-verifiergithub.com/openshift/backplane-cli
This means:
- The
aws-sdkgroup (line 15-17) will never trigger updates because no AWS SDK dependencies are in the allow list. - The
kubernetesgroup (line 18-21) will never trigger updates because no k8s.io or sigs.k8s.io dependencies are in the allow list. - Only the
openshiftgroup could match the two allowed dependencies.
Action required: Either:
- Remove the
allowblock entirely to enable updates for all dependencies (recommended if you want AWS SDK and Kubernetes updates), OR - Remove the unused
aws-sdkandkubernetesgroups if they're not needed, OR - Expand the
allowlist to include specific AWS and Kubernetes dependencies that should be updated.
♻️ Option 1: Remove allow block to enable all dependency updates
labels:
- "area/dependency"
- "ok-to-test"
- allow:
- - dependency-name: "github.com/openshift/osd-network-verifier"
- - dependency-name: "github.com/openshift/backplane-cli"
schedule:
interval: 'weekly'♻️ Option 2: Remove unused groups
open-pull-requests-limit: 10
groups:
- aws-sdk:
- patterns:
- - "github.com/aws/aws-sdk-go-v2*"
- kubernetes:
- patterns:
- - "k8s.io/*"
- - "sigs.k8s.io/*"
openshift:
patterns:
- "github.com/openshift/*"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| allow: | |
| - dependency-name: "github.com/openshift/osd-network-verifier" | |
| - dependency-name: "github.com/openshift/backplane-cli" | |
| schedule: | |
| interval: 'daily' | |
| interval: 'weekly' | |
| open-pull-requests-limit: 10 | |
| groups: | |
| aws-sdk: | |
| patterns: | |
| - "github.com/aws/aws-sdk-go-v2*" | |
| kubernetes: | |
| patterns: | |
| - "k8s.io/*" | |
| - "sigs.k8s.io/*" | |
| openshift: | |
| patterns: | |
| - "github.com/openshift/*" | |
| schedule: | |
| interval: 'weekly' | |
| open-pull-requests-limit: 10 | |
| groups: | |
| aws-sdk: | |
| patterns: | |
| - "github.com/aws/aws-sdk-go-v2*" | |
| kubernetes: | |
| patterns: | |
| - "k8s.io/*" | |
| - "sigs.k8s.io/*" | |
| openshift: | |
| patterns: | |
| - "github.com/openshift/*" |
| allow: | |
| - dependency-name: "github.com/openshift/osd-network-verifier" | |
| - dependency-name: "github.com/openshift/backplane-cli" | |
| schedule: | |
| interval: 'daily' | |
| interval: 'weekly' | |
| open-pull-requests-limit: 10 | |
| groups: | |
| aws-sdk: | |
| patterns: | |
| - "github.com/aws/aws-sdk-go-v2*" | |
| kubernetes: | |
| patterns: | |
| - "k8s.io/*" | |
| - "sigs.k8s.io/*" | |
| openshift: | |
| patterns: | |
| - "github.com/openshift/*" | |
| allow: | |
| - dependency-name: "github.com/openshift/osd-network-verifier" | |
| - dependency-name: "github.com/openshift/backplane-cli" | |
| schedule: | |
| interval: 'weekly' | |
| open-pull-requests-limit: 10 | |
| groups: | |
| openshift: | |
| patterns: | |
| - "github.com/openshift/*" |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/dependabot.yml around lines 8 - 24, The dependabot config's allow
list currently limits updates to only the two OpenShift packages, making the
"aws-sdk" and "kubernetes" groups unreachable; fix by either removing the
top-level allow block (so groups aws-sdk, kubernetes, openshift are evaluated),
or if you want to keep allow, remove the unused "aws-sdk" and "kubernetes" group
entries, or expand the allow list to include the specific AWS and Kubernetes
dependencies you want Dependabot to update (update the "allow" entries or adjust
"groups" patterns accordingly).
2 participants
Summary
ROSA-745 phase 2 — per-repo dependency automation (not on boilerplate).
Draft — for team review before merge. Depends on DPP branch protection (openshift/release#80263) for required checks.
Test plan
Summary by CodeRabbit