ci: replace dependabot auto-vet bot commit with patch artifact#2467
ci: replace dependabot auto-vet bot commit with patch artifact#2467bronzelle-cw wants to merge 5 commits intomainfrom
Conversation
bronzelle-cw
commented
Mar 10, 2026
bronzelle-cw
commented
- What changed:
- Replaced bot commit/push flow with patch generation and artifact upload.
- Updated PR comment to explain how authors apply the patch locally.
- Why:
- Keeps final commit ownership and signing with the PR author.
- Reduces workflow complexity compared with a review-suggestion engine.
PR Reviewer Guide 🔍Here are some key observations to aid the review process:
|
PR Code Suggestions ✨Explore these optional code suggestions:
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2467 +/- ##
==========================================
+ Coverage 84.26% 84.34% +0.07%
==========================================
Files 141 141
Lines 10826 10826
==========================================
+ Hits 9123 9131 +8
+ Misses 1703 1695 -8 Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![cloudwalk-review-agent[bot]](https://avatars.githubusercontent.com/u/6581007?s=60&v=4){kind=small}
There was a problem hiding this comment.
Follow-up
✅ unzip -p path fixed — the fallback block now correctly references vet/auto-vet.patch inside the zip. Good catch addressed.
Two issues remain: the -S GPG signing flag (flagged last round, still present in both blocks), and a new path bug in the gh run download block that will make git apply fail for anyone who uses the preferred flow.
There was a problem hiding this comment.
Follow-up
✅ unzip -p path fixed — fallback block now correctly references vet/auto-vet.patch inside the zip. Good.
Three issues remain (two carried over, one new):
- New bug:
mkdir -p vetis missing before thegit diff … > "$patch_path"redirect — if thevet/directory doesn't already exist the shell will immediately error with No such file or directory and the patch step will exit 1 silently discarding the diff. - Carried over:
git apply --index auto-vet.patchin thegh run downloadblock still references the wrong path. - Carried over:
-S(GPG signing) in both commit blocks will silently fail or error for developers without a signing key configured.
| echo "changed=true" >> "$GITHUB_OUTPUT" | ||
| echo "sha=$sha" >> "$GITHUB_OUTPUT" | ||
| echo "pushed=true" >> "$GITHUB_OUTPUT" | ||
| git diff --binary --patch -- supply-chain > "$patch_path" |
There was a problem hiding this comment.
mkdir -p vet still missing (flagged in previous review).
patch_path is set to vet/auto-vet.patch but the vet/ directory is never created. The shell redirect will fail with No such file or directory on a clean runner where vet/ doesn't already exist. Fix:
mkdir -p vet
git diff --binary --patch -- supply-chain > "$patch_path"| lines.push('```bash'); | ||
| lines.push('git checkout <pr-branch>'); | ||
| lines.push(`gh run download ${runId} -n ${artifactName}`); | ||
| lines.push(`git apply --index auto-vet.patch`); |
There was a problem hiding this comment.
Bug (carried over): wrong apply path after gh run download.
gh run download <run-id> -n <artifact-name> creates <artifactName>/ and preserves the uploaded directory structure inside it. Because the file was uploaded from vet/auto-vet.patch, it lands at <artifactName>/vet/auto-vet.patch — not auto-vet.patch. This instruction will fail with error: can't open patch file auto-vet.patch for anyone using the preferred CLI flow.
Fix:
git apply --index ${artifactName}/vet/auto-vet.patch| lines.push(`gh run download ${runId} -n ${artifactName}`); | ||
| lines.push(`git apply --index auto-vet.patch`); | ||
| lines.push('git status'); | ||
| lines.push('git commit -S -m "chore(vet): apply automated audits"'); |
There was a problem hiding this comment.
-S still requires a GPG key (flagged in first review, present in both blocks).
git commit -S (uppercase) is GPG commit signing — it fails or produces an unverified commit for developers without a signing key configured. Use lowercase -s (DCO/Signed-off-by trailer) if a traceable attribution line is wanted, or drop the flag and let the developer sign per their own setup. Same issue at the fallback block (~line 524).
carneiro-cw
left a comment
carneiro-cw
left a comment
There was a problem hiding this comment.
I tried running the action on the branch test_vet_2 multiple times, and it neither generated artifact nor it commented on the PR. https://github.com/cloudwalk/stratus/actions/runs/23492063861/job/68362706808
The patch generation did happen, but that run was started manually, and this automation is only meant to fully work in a PR-triggered run. With workflow_dispatch, GitHub starts the workflow from a branch/ref, not from a PR context, so the job does not know which PR it should attach the result to or comment on. Because of that, manual runs are not a valid test for the “upload artifact + comment on the PR” path. That connects with the other guard in this workflow: the PR-triggered path was also restricted to PRs opened by dependabot[bot]. I retried on the same test_vet_2 branch, removing only that PR author check, and with that change the automation worked as expected on the PR path, including the artifact/comment behavior. The test run did not go through the expected path because it was a manual dispatch. |
There was a problem hiding this comment.
Follow-up
✅ mkdir -p vet — the Prepare workspace step already runs mkdir -p vet/diffs vet/prompts vet/decisions, which creates vet/ before the patch step. No longer an issue.
✅ unzip -p fallback path — correctly references vet/auto-vet.patch inside the zip.
Two issues remain:
gh run downloadapply path still wrong —gh run downloadpreserves directory structure, so the patch lands at${artifactName}/vet/auto-vet.patch, notauto-vet.patch. The preferred CLI block still usesgit apply --index auto-vet.patch, which will fail with error: can't open patch file auto-vet.patch.-Sflag requires GPG — still present in both blocks.
| lines.push('```bash'); | ||
| lines.push('git checkout <pr-branch>'); | ||
| lines.push(`gh run download ${runId} -n ${artifactName}`); | ||
| lines.push(`git apply --index auto-vet.patch`); |
There was a problem hiding this comment.
Bug (carried over): wrong apply path after gh run download.
gh run download <run-id> -n <artifact-name> creates <artifactName>/ and preserves the directory structure uploaded. Because the file was uploaded from vet/auto-vet.patch, it lands at <artifactName>/vet/auto-vet.patch — not auto-vet.patch at the top level. This will fail for any developer using the preferred CLI flow.
Fix:
git apply --index ${artifactName}/vet/auto-vet.patch| lines.push(`gh run download ${runId} -n ${artifactName}`); | ||
| lines.push(`git apply --index auto-vet.patch`); | ||
| lines.push('git status'); | ||
| lines.push('git commit -S -m "chore(vet): apply automated audits"'); |
There was a problem hiding this comment.
-S still requires a GPG key (flagged in every previous review).
git commit -S is GPG commit signing — it fails silently or errors for developers without a signing key configured. Drop the flag or replace with -s (DCO Signed-off-by trailer). Same issue at the fallback block (line 524).
2 participants
