chore(ci): Add automated ratchet update workflow and disable dependabot actions updates#795
chore(ci): Add automated ratchet update workflow and disable dependabot actions updates#795
Conversation
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the WalkthroughDependabot configuration was changed to use an empty updates list. A new GitHub Actions workflow, “Ratchet update,” was added to periodically pin action SHAs and open a PR with changes detected in workflow files. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor User as User
participant GH as GitHub Actions
participant Job as Job: update
participant Repo as Repository
participant Ratchet as ratchet
Note over GH: Triggers: schedule (Mon 00:00 UTC) or workflow_dispatch
GH->>Job: Start workflow (permissions: contents/prs write)
Job->>Repo: actions/checkout@v4
Job->>Job: Setup Go (stable)
Job->>Job: Install ratchet v0.11.3
Job->>Ratchet: ratchet update .github/workflows/*.yml
Ratchet-->>Job: Updated workflow files (if any)
Job->>Repo: git diff
alt Changes detected
Job->>Repo: create-pull-request@v6<br/>branch: chore/update-actions-shas
Repo-->>User: PR "chore(ci): Update pinned GitHub Actions SHAs"
else No changes
Job->>GH: Exit without PR
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
Status, Documentation and Community
|
|
Claude encountered an error —— View job I'll analyze this and get back to you. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary of Changes
Hello @yamadashy, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
This pull request transitions the repository's GitHub Actions dependency update mechanism from Dependabot to a new, more controlled automated workflow utilizing Ratchet. The primary goal is to gain more predictable updates for GitHub Actions SHAs, reducing the frequency of pull requests generated by Dependabot while maintaining security and ensuring proper SHA pinning. This involves adding a new workflow for Ratchet-based updates and disabling the corresponding Dependabot configuration.
Highlights
- New Automated Workflow for GitHub Actions SHA Updates: A new workflow file,
.github/workflows/ratchet-update.yml, has been introduced. This workflow is designed to automate weekly GitHub Actions SHA updates using the Ratchet tool, supporting manual triggering and automatic pull request creation when updates are available. This ensures proper permissions and security through SHA pinning. - Dependabot Configuration Update: The
.github/dependabot.ymlfile has been modified to remove thegithub-actionspackage ecosystem entry. This change disables Dependabot's ability to create pull requests for GitHub Actions updates, preventing redundant update mechanisms and reducing PR noise. - Improved Control and Predictability of Updates: The overall approach shifts from Dependabot's frequent updates to a Ratchet-based system, providing more controlled and predictable updates for GitHub Actions. This change aims to maintain security while offering a more streamlined update process.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Pull Request Overview
This PR replaces dependabot's GitHub Actions updates with a custom ratchet-based automation workflow to provide more controlled and predictable SHA updates.
- Introduces automated weekly ratchet workflow for GitHub Actions SHA updates
- Disables dependabot's github-actions ecosystem to prevent duplicate automation
- Implements proper PR creation workflow with manual trigger capability
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
.github/workflows/ratchet-update.yml |
New workflow implementing weekly automated SHA updates using ratchet v0.11.3 |
.github/dependabot.yml |
Removes github-actions ecosystem configuration, leaving empty updates array |
Deploying repomix with
|
| Latest commit: |
c42aa4f
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://1b3589ce.repomix.pages.dev |
| Branch Preview URL: | https://chore-ratchet-update-ci.repomix.pages.dev |
There was a problem hiding this comment.
Code Review
This pull request correctly disables Dependabot for GitHub Actions updates by modifying dependabot.yml, in preparation for using a new ratchet workflow. The change is simple and effective. I have one suggestion regarding the dependabot.yml file to improve repository maintainability by removing unnecessary configuration.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #795 +/- ##
=======================================
Coverage 88.59% 88.59%
=======================================
Files 110 110
Lines 6192 6192
Branches 1282 1282
=======================================
Hits 5486 5486
Misses 706 706 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (6)
.github/workflows/ratchet-update.yml (6)
14-16: Add ratchet annotation for actions/checkout so it can be auto-updated.Without a ratchet:… mapping comment, ratchet can’t resolve which ref to track. You used the correct annotation for setup-go; mirror that here.
Apply:
- - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4 + - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4
18-21: Optional: Pin Go to a minor release for reproducibility.go-version: stable is fine, but pinning to a minor version reduces drift in ratchet’s build environment.
- go-version: stable + go-version: "1.22.x"
27-30: Include .yaml files in ratchet update target.Some workflows may use .yaml. Broadening the glob reduces the chance of missed updates.
- ratchet update .github/workflows/*.yml + ratchet update .github/workflows/*.{yml,yaml}
40-43: Add ratchet annotation for create-pull-request action.Same rationale as checkout — without the ratchet tag mapping, ratchet won’t know which ref to track.
- uses: peter-evans/create-pull-request@70a41aba780001da0a30141984ae2a0c95d8704e # v6 + uses: peter-evans/create-pull-request@70a41aba780001da0a30141984ae2a0c95d8704e # ratchet:peter-evans/create-pull-request@v6
54-56: Pre-checked checklist is misleading since the workflow doesn’t run tests/lint.Either remove the checklist or leave boxes unchecked to reflect reality.
- - [x] Run `npm run test` - - [x] Run `npm run lint` + - [ ] Run `npm run test` + - [ ] Run `npm run lint`
58-58: Add a trailing newline.YAMLlint flagged “no new line at end of file.” Add a newline for POSIX compatibility.
- delete-branch: true + delete-branch: true +
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
.github/dependabot.yml(1 hunks).github/workflows/ratchet-update.yml(1 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
.github/workflows/ratchet-update.yml
[error] 58-58: no new line character at the end of file
(new-line-at-end-of-file)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
- GitHub Check: Test (macos-latest, 24.x)
- GitHub Check: Test (macos-latest, 21.x)
- GitHub Check: Test (ubuntu-latest, 23.x)
- GitHub Check: Test (windows-latest, 23.x)
- GitHub Check: Test (windows-latest, 21.x)
- GitHub Check: Test (windows-latest, 22.x)
- GitHub Check: Test (windows-latest, 20.x)
- GitHub Check: Build and run (windows-latest, 20.x)
🔇 Additional comments (2)
.github/workflows/ratchet-update.yml (2)
10-12: Permissions look good.contents: write and pull-requests: write are the correct minimal permissions for committing and opening PRs.
31-38: Change detection logic is sound.git diff --quiet is a clean way to signal whether there are staged/unstaged changes. Using GITHUB_OUTPUT is correct.
…ot actions updates - Add ratchet-update.yml workflow for weekly automated SHA updates - Disable dependabot github-actions updates in dependabot.yml - Workflow creates PRs automatically when updates are available
yamadashy
force-pushed
the
chore/ratchet-update-ci
branch
from
1f99b0b to
5cba089
Compare
- Update all workflow files with latest action SHAs using ratchet - Ensure security through SHA pinning while using current versions - Automated update as part of ratchet workflow implementation
Summary
This PR introduces automated GitHub Actions SHA updates using ratchet instead of dependabot:
ratchet-update.ymlworkflow for weekly automated SHA updatesdependabot.ymlChanges
New Workflow Features
workflow_dispatchDependabot Configuration
This approach provides more controlled and predictable GitHub Actions updates compared to dependabot's frequent PRs.
Checklist
npm run testnpm run lint