Repository navigation
ci: regenerate THIRD-PARTY-NOTICES.txt on Dependabot pull requests - #5
Merged
Merged
Conversation
Dependabot cannot run the script, so bumping a crate linked into the executables failed the notices check, which also skipped clippy, the tests and the MSI. The new workflow commits the regenerated file to the pull request branch and starts CI on that commit with workflow_dispatch, because a GITHUB_TOKEN push does not start CI by itself. No secrets are needed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot can't run
scripts/third-party-notices.ps1, so any bump of a crate linked into the executables fails the notices check in CI, as #3 did. That step also skips clippy, the tests and the MSI.This adds a workflow that regenerates the file on Dependabot pull requests, commits it to the branch and starts CI on the new commit.
GITHUB_TOKENdoesn't start CI by itself, so the workflow usesworkflow_dispatch. No secrets are needed.[dependabot skip]in the commit message lets Dependabot keep rebasing the branch. A rebase drops the commit and the workflow adds it again.release.yml, with the third-party action pinned to a commit SHA.workflow_dispatchonly works once the file is onmain, so the end-to-end test has to happen after merging.🤖 Generated with Claude Code