From 9a0fa541a39b354a5389aefabeccca09222f8c83 Mon Sep 17 00:00:00 2001 From: cm-dyoshikawa Date: Tue, 25 Aug 2026 22:48:29 -0700 Subject: [PATCH] revert: remove the scheduled Dependabot auto-merge workflow Reverts #2702 (merge commit bf29decb3) at the maintainer's request. Removes .github/workflows/dependabot-auto-merge.yml and restores the github-actions-security rule to describing draft-release.yml as the only workflow that reaches https://opencode.ai/install. --- .github/workflows/dependabot-auto-merge.yml | 101 -------------------- .rulesync/rules/github-actions-security.md | 6 +- 2 files changed, 3 insertions(+), 104 deletions(-) delete mode 100644 .github/workflows/dependabot-auto-merge.yml diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml deleted file mode 100644 index 233047752..000000000 --- a/.github/workflows/dependabot-auto-merge.yml +++ /dev/null @@ -1,101 +0,0 @@ -name: Dependabot Auto Merge - -# Runs the `babysit-dependabot-pr` skill against every open Dependabot PR. -# -# Deliberately NOT triggered by the `pull_request` event: a Dependabot-originated -# `pull_request` run receives the Dependabot secrets store rather than the regular -# Actions secrets, so `OPENROUTER_API_KEY` would be unavailable, and -# `pull_request_target` would widen the injection surface for event data without -# reducing the real risk (CI executes the bumped dependencies either way). -# `schedule` + `workflow_dispatch` avoids both: the workflow definition always runs -# from `main`, regular secrets are available, and the prompt stays fully static — -# the agent discovers the PRs itself, so no untrusted event data is interpolated -# into it (see .github/workflows/AGENTS.md). -on: - schedule: - - cron: "0 3 * * *" - workflow_dispatch: - -permissions: - contents: read - -concurrency: - group: dependabot-auto-merge - cancel-in-progress: false - -jobs: - dependabot-auto-merge: - # The `github.actor` gate mirrors `draft-release.yml`, so the job that receives - # the model key and a write-scoped token stays reachable only through the - # schedule — whose definition always comes from `main` — or a maintainer's own - # dispatch. - if: >- - github.event_name == 'schedule' || - github.actor == 'dyoshikawa' || - github.actor == 'cm-dyoshikawa' - runs-on: ubuntu-latest - timeout-minutes: 60 - permissions: - contents: write - pull-requests: write - issues: write - steps: - - name: Checkout repository - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 - with: - fetch-depth: 0 - - # A cheap pre-check so an empty run burns no model tokens. - - name: Check for open Dependabot pull requests - id: check - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - count=$(gh pr list --state open --author "app/dependabot" --json number --jq 'length') - echo "count=${count}" >> "$GITHUB_OUTPUT" - echo "Open Dependabot pull requests: ${count}" - - - name: Configure git - if: steps.check.outputs.count != '0' - uses: ./.github/actions/git-config - - - name: Setup mise - if: steps.check.outputs.count != '0' - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5 - with: - experimental: true - - - name: Setup Takumi Guard npm registry - if: steps.check.outputs.count != '0' - uses: flatt-security/setup-takumi-guard-npm@6d4182745c1e474c35a023573c2612c085be45a4 # v1 - - - name: Install dependencies - if: steps.check.outputs.count != '0' - run: pnpm install --ignore-scripts - - - name: Generate rules - if: steps.check.outputs.count != '0' - run: pnpm generate - - - name: Run OpenCode to babysit Dependabot pull requests - if: steps.check.outputs.count != '0' - uses: anomalyco/opencode/github@2b72179c663cadcb54f54d9f19221b3fb3d11fb6 # v1.18.19 - env: - OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }} - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - with: - # Hard-coded rather than resolved through ./.github/actions/select-opencode-model, - # which maps the `deepseek` keyword to `openrouter/deepseek/deepseek-v4-pro`. - model: openrouter/deepseek/deepseek-v4-flash-0731 - use_github_token: "true" - share: false - prompt: | - List the open Dependabot pull requests with `gh pr list --state open --author "app/dependabot"`. - For each one, run the `babysit-dependabot-pr` skill with that pull request number, one pull request at a time. - The skill verifies the author is the genuine Dependabot bot, diagnoses any CI failure, excludes or fixes a breaking bump, and merges once every check is green. - Do not act on any pull request whose author is not Dependabot. - - This repository's `main` ruleset lists no bypass actor for the Actions app, so - `gh pr merge --admin` cannot force a merge from here. Merge with - `gh pr merge --merge` instead, and if the ruleset rejects it, leave the - pull request open and report why rather than retrying with `--admin`. diff --git a/.rulesync/rules/github-actions-security.md b/.rulesync/rules/github-actions-security.md index 0122dd2db..d3297d70c 100644 --- a/.rulesync/rules/github-actions-security.md +++ b/.rulesync/rules/github-actions-security.md @@ -27,14 +27,14 @@ Reference: https://docs.github.com/ja/actions/concepts/security/script-injection Third-party GitHub Actions are pinned to a full 40-character commit SHA with a trailing `# vX.Y.Z` comment. Keep that convention when adding or bumping an action. -`anomalyco/opencode/github` (used by `draft-release.yml` and `dependabot-auto-merge.yml`) is a composite action, so its SHA pin covers the wrapper only: +`anomalyco/opencode/github` (used by `draft-release.yml`) is a composite action, so its SHA pin covers the wrapper only: - The wrapper resolves the `opencode` CLI release to `latest` at run time and installs it with `curl -fsSL https://opencode.ai/install | bash`, so the binary that actually receives the workflow secrets is not pinned by the SHA. - The wrapper also uses `actions/cache@v4` internally, by mutable tag. -The accepted stance is to treat `https://opencode.ai/install` as a trusted install path rather than vendoring a pinned installer, because the workflows that reach it cannot be triggered by an outside contributor: `draft-release.yml` is `workflow_dispatch`-only and gated on `github.actor`, and `dependabot-auto-merge.yml` runs on a `schedule` — whose definition always comes from `main` — plus a `workflow_dispatch` carrying the same actor gate. Bumping the pin is still worthwhile for the wrapper itself, but do not read it as a guarantee about the CLI version. +The accepted stance is to treat `https://opencode.ai/install` as a trusted install path rather than vendoring a pinned installer, because `draft-release.yml` is `workflow_dispatch`-only and gated on `github.actor`, so an outside contributor cannot trigger it. Bumping the pin is still worthwhile for the wrapper itself, but do not read it as a guarantee about the CLI version. -The residual risk this stance accepts is that a compromise of the distribution endpoint would expose whatever the workflow hands the CLI — the model API keys and a `GITHUB_TOKEN` with `contents: write`, `pull-requests: write`, and `issues: write`. The `github.actor` gate limits _who can trigger_ the workflow; it does not reduce that exposure on a maintainer-triggered run, and a scheduled run has no triggering actor to gate at all. Revisit this if either workflow ever becomes externally triggerable, if the token or secret scope it receives grows, or if upstream adds a `version` input that lets the CLI itself be pinned. +The residual risk this stance accepts is that a compromise of the distribution endpoint would expose whatever the workflow hands the CLI — the model API keys and a `GITHUB_TOKEN` with `contents: write`, `pull-requests: write`, and `issues: write`. The `github.actor` gate limits _who can trigger_ the workflow; it does not reduce that exposure on a maintainer-triggered run. Revisit this if the workflow ever becomes externally triggerable, if the token or secret scope it receives grows, or if upstream adds a `version` input that lets the CLI itself be pinned. ## OIDC Permissions