From a7e2f3418f1bd766fe847b5853583d19fde91d23 Mon Sep 17 00:00:00 2001 From: Chandler Carruth Date: Mon, 2 Nov 2026 22:12:42 +0000 Subject: [PATCH] Setup dependabot updates for more layers, and improve commits (#8073) This configures dependabot to update our GitHub actions, our pre-commit steps, and our Bazel modules. It also adds a workflow to replace PR descriptions from Dependabot with ones that work well with our squash-merge setup. Last but not least, a couple of cases were missing SHA-pinning and it is added here. Assisted-by: Antigravity with Gemini --- .github/dependabot.yml | 61 ++++++++++++++++ .github/workflows/auto_label_prs.yaml | 2 +- .../workflows/dependabot_pr_description.yaml | 70 +++++++++++++++++++ .pre-commit-config.yaml | 5 +- 4 files changed, 135 insertions(+), 3 deletions(-) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/dependabot_pr_description.yaml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000000..ad0c61ecbece --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,61 @@ +# Part of the Carbon Language project, under the Apache License v2.0 with LLVM +# Exceptions. See /LICENSE for license information. +# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception + +# Dependabot version updates for our GitHub Actions, pre-commit hooks, and Bazel +# modules. See .github/workflows/README.md for how these PRs are handled. +# +# Updates keep our existing pinning: actions stay pinned to full commit SHAs +# with a `# vX.Y.Z` comment, and pre-commit hooks stay frozen to commit SHAs +# with a `# frozen: vX.Y.Z` comment. +# +# Security updates for other ecosystems, such as npm and pip, are enabled in the +# repository settings and don't need an entry here. + +version: 2 + +updates: + - package-ecosystem: github-actions + # `/` only covers `.github/workflows`; list composite actions separately. + directories: ['/', '/.github/actions/*'] + schedule: + interval: weekly + # Give new releases a week to be vetted before we adopt them. + cooldown: + default-days: 7 + # Use our existing label instead of Dependabot's per-ecosystem labels. + labels: ['dependencies'] + groups: + # Batch minor and patch updates, but put major updates in a separate PR so + # they get a closer look. + github-actions: + patterns: ['*'] + update-types: ['minor', 'patch'] + github-actions-major: + patterns: ['*'] + update-types: ['major'] + + - package-ecosystem: pre-commit + directory: '/' + schedule: + interval: monthly + cooldown: + default-days: 7 + labels: ['dependencies'] + groups: + pre-commit: + patterns: ['*'] + + # Dependabot regenerates `MODULE.bazel.lock` on a single platform, so the test + # workflow may still ask for platform-specific lockfile updates. LLVM is + # pinned with `git_override`, which Dependabot doesn't update. + - package-ecosystem: bazel + directory: '/' + schedule: + interval: monthly + cooldown: + default-days: 7 + labels: ['dependencies'] + groups: + bazel: + patterns: ['*'] diff --git a/.github/workflows/auto_label_prs.yaml b/.github/workflows/auto_label_prs.yaml index 4f0cb2f10689..f4b36c8392ac 100644 --- a/.github/workflows/auto_label_prs.yaml +++ b/.github/workflows/auto_label_prs.yaml @@ -113,7 +113,7 @@ jobs: # and it applies orthogonally to the others. - id: bot if: - contains(fromJSON('["CarbonInfraBot", "dependabot"]'), + contains(fromJSON('["CarbonInfraBot", "dependabot[bot]"]'), github.event.pull_request.user.login) run: | gh pr edit "${PR}" --add-label "bot" --repo carbon-language/carbon-lang diff --git a/.github/workflows/dependabot_pr_description.yaml b/.github/workflows/dependabot_pr_description.yaml new file mode 100644 index 000000000000..17e47e4e7941 --- /dev/null +++ b/.github/workflows/dependabot_pr_description.yaml @@ -0,0 +1,70 @@ +# Part of the Carbon Language project, under the Apache License v2.0 with LLVM +# Exceptions. See /LICENSE for license information. +# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception + +# Replaces Dependabot's PR description with a short markdown list of the updated +# dependencies. We squash-merge using the PR description as the commit message, +# and Dependabot's descriptions are mostly HTML: release notes, commit lists, +# and command help. The original description remains in the PR's edit history. +name: 'Dependabot PR description' + +on: + pull_request: + types: [opened, reopened, synchronize, edited] + +# Dependabot can push and edit the description in quick succession. +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number }} + cancel-in-progress: true + +permissions: {} + +jobs: + rewrite: + if: github.event.pull_request.user.login == 'dependabot[bot]' + runs-on: ubuntu-latest + permissions: + contents: read # For dependabot/fetch-metadata to read the PR's commit. + pull-requests: write # For `gh pr edit`. + steps: + - name: Harden Runner + uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3 + with: + disable-sudo: true + egress-policy: block + # prettier-ignore + allowed-endpoints: > + api.github.com:443 + + - id: metadata + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 + + - name: Replace the description + env: + BODY: ${{ github.event.pull_request.body }} + DEPENDENCIES: ${{ steps.metadata.outputs.updated-dependencies-json }} + GH_TOKEN: ${{ github.token }} + PR_URL: ${{ github.event.pull_request.html_url }} + run: | + # Only replace a description that Dependabot wrote, which always + # contains this marker. This leaves human edits alone, and catches + # Dependabot restoring its description when it rebases. + if [[ "$BODY" != *dependabot-automerge-start* ]]; then + echo "The description isn't Dependabot's, so leaving it alone." + exit 0 + fi + + # One short line per dependency. GitHub hard-wraps squash commit + # messages at 72 columns, so avoid tables and long links. + body="$(jq -r ' + unique_by([.dependencyName, .prevVersion, .newVersion])[] + | "- `\(.dependencyName)` \(.prevVersion) -> \(.newVersion)" + + if .updateType == "version-update:semver-major" + then " (major)" else "" end + ' <<<"$DEPENDENCIES")" + if [[ -z "$body" ]]; then + echo "Found no updated dependencies, so leaving it alone." + exit 0 + fi + + gh pr edit "$PR_URL" --repo "$GITHUB_REPOSITORY" --body "$body" diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 57dd3a630198..29ebe7d66420 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -4,6 +4,7 @@ # Update versions with: # pre-commit autoupdate --freeze && pre-commit run -a +# Dependabot also proposes monthly updates; see .github/dependabot.yml. # See https://pre-commit.com for more information # See https://pre-commit.com/hooks.html for more hooks @@ -32,7 +33,7 @@ repos: # Run markdown linting early so that doc style and table-of-contents see the # linted state. - repo: https://github.com/rvben/rumdl-pre-commit - rev: v0.2.58 + rev: e95b9121d4c55bf12fb7ae52d08d2d8d64789899 # frozen: v0.2.58 hooks: - id: rumdl args: [--fix] @@ -51,7 +52,7 @@ repos: # Re-run markdown linting to fix any issues caused by doc style and TOC. This # is very fast, so it shouldn't be problematic to run twice. - repo: https://github.com/rvben/rumdl-pre-commit - rev: v0.2.58 + rev: e95b9121d4c55bf12fb7ae52d08d2d8d64789899 # frozen: v0.2.58 hooks: - id: rumdl args: [--fix]