Skip to content

Support updatecli in gh-aw-dependency-review #533

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
strawgate merged 4 commits into from
Mar 2, 2026
Merged

Support updatecli in gh-aw-dependency-review #533

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3d0356f
Initial plan
Copilot Mar 2, 2026
fc0f189
Support updatecli in gh-aw-dependency-review workflow
Copilot Mar 2, 2026
9c4fd5d
Merge branch 'main' into copilot/support-updatecli-dependency-workflow
strawgate Mar 2, 2026
77ba3f0
Add allowed-bot-users guidance for updatecli in example.yml and README
Copilot Mar 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/gh-aw-dependency-review.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
inlined-imports: true
name: "Dependency Review"
description: "Analyze Dependabot and Renovate dependency update PRs"
description: "Analyze Dependabot, Renovate, and Updatecli dependency update PRs"
imports:
- gh-aw-fragments/elastic-tools.md
- gh-aw-fragments/runtime-setup.md
Expand Down Expand Up @@ -84,7 +84,7 @@ steps:

# Dependency Review Agent

Analyze dependency update pull requests (Dependabot, Renovate) in ${{ github.repository }}. Provide a detailed analysis comment covering changelog highlights, compatibility, risk, and ecosystem-specific checks.
Analyze dependency update pull requests (Dependabot, Renovate, Updatecli) in ${{ github.repository }}. Provide a detailed analysis comment covering changelog highlights, compatibility, risk, and ecosystem-specific checks.

## Context

Expand Down
6 changes: 5 additions & 1 deletion .github/workflows/trigger-dependency-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,11 @@ jobs:
run:
if: >-
github.event.pull_request.user.login == 'dependabot[bot]' ||
github.event.pull_request.user.login == 'renovate[bot]'
github.event.pull_request.user.login == 'renovate[bot]' ||
startsWith(github.head_ref, 'updatecli')
Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[HIGH] Updatecli trigger can fail authorization in called workflow

This adds startsWith(github.head_ref, 'updatecli'), but this caller still invokes gh-aw-dependency-review.lock.yml without passing allowed-bot-users, while the called workflow allowlist is $\{\{ inputs.allowed-bot-users }},dependabot[bot],renovate[bot] and defaults allowed-bot-users to github-actions[bot]. For repo-installed Updatecli bots (commonly custom bot usernames), the workflow will trigger here but then fail activation/membership checks and skip dependency analysis.

Please pass the PR bot login through with.allowed-bot-users (or explicitly include Updatecli bot identities) in this workflow call so the new trigger path is actually executable.

uses: ./.github/workflows/gh-aw-dependency-review.lock.yml
# For updatecli: uncomment and set your repo's updatecli bot actor (it varies per repo).
# with:
# allowed-bot-users: "github-actions[bot]"
secrets:
COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
2 changes: 1 addition & 1 deletion docs/workflows/gh-agent-workflows.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ These pair together: a Scheduled Audit finds problems, a Scheduled Fix resolves

| Workflow | Trigger | Description |
| --- | --- | --- |
| [Dependency Review](gh-agent-workflows/dependency-review.md) | Dependabot/Renovate PRs | Analyze dependency updates across ecosystems with changelog, compatibility, and risk checks |
| [Dependency Review](gh-agent-workflows/dependency-review.md) | Dependabot/Renovate/Updatecli PRs | Analyze dependency updates across ecosystems with changelog, compatibility, and risk checks |
| [Duplicate Issue Detector](gh-agent-workflows/duplicate-issue-detector.md) | New issues | Detect duplicate issues and comment with links |
| [Issue Triage](gh-agent-workflows/issue-triage.md) | New issues | Investigate and provide implementation plans |
| [Issue Fixer](gh-agent-workflows/issue-fixer.md) | New issues | Triage plus automatic draft PR for straightforward fixes |
Expand Down
8 changes: 4 additions & 4 deletions gh-agent-workflows/dependency-review/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
# Dependency Review

Analyze Dependabot and Renovate dependency update PRs.
Analyze Dependabot, Renovate, and Updatecli dependency update PRs.

## How it works

Triggered when Dependabot or Renovate opens or updates a PR. Classifies each dependency by ecosystem (GitHub Actions, Go, npm, Python, Java, Buildkite, etc.), runs shared checks (changelog, usage analysis, compatibility, testability), and applies ecosystem-specific checks where relevant. Posts a structured analysis comment and optionally labels the PR `needs-human-review` or `higher-risk`.
Triggered when Dependabot, Renovate, or Updatecli opens or updates a PR. Classifies each dependency by ecosystem (GitHub Actions, Go, npm, Python, Java, Buildkite, etc.), runs shared checks (changelog, usage analysis, compatibility, testability), and applies ecosystem-specific checks where relevant. Posts a structured analysis comment and optionally labels the PR `needs-human-review` or `higher-risk`.

## Quick Install

Expand All @@ -20,15 +20,15 @@ See [example.yml](example.yml) for the full workflow file.

| Event | Types | Condition |
| --- | --- | --- |
| `pull_request` | `opened`, `synchronize`, `reopened` | PR author is `dependabot[bot]` or `renovate[bot]` |
| `pull_request` | `opened`, `synchronize`, `reopened` | PR author is `dependabot[bot]` or `renovate[bot]`, or branch name starts with `updatecli` |

## Inputs

| Input | Description | Required | Default |
| --- | --- | --- | --- |
| `additional-instructions` | Repo-specific instructions appended to the agent prompt | No | `""` |
| `setup-commands` | Shell commands run before the agent starts | No | `""` |
| `allowed-bot-users` | Allowlisted bot actor usernames (comma-separated) | No | `github-actions[bot]` |
| `allowed-bot-users` | Allowlisted bot actor usernames (comma-separated). For Updatecli, add your repo's updatecli bot actor here (e.g. `github-actions[bot]` or a custom app bot). | No | `github-actions[bot]` |

## Safe Outputs

Expand Down
6 changes: 5 additions & 1 deletion gh-agent-workflows/dependency-review/example.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,11 @@ jobs:
run:
if: >-
github.event.pull_request.user.login == 'dependabot[bot]' ||
github.event.pull_request.user.login == 'renovate[bot]'
github.event.pull_request.user.login == 'renovate[bot]' ||
startsWith(github.head_ref, 'updatecli')
uses: elastic/ai-github-actions/.github/workflows/gh-aw-dependency-review.lock.yml@v0
# For updatecli: uncomment and set your repo's updatecli bot actor (it varies per repo).
# with:
# allowed-bot-users: "github-actions[bot]"
secrets:
COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
Loading