Repository navigation
Run Dependabot pull requests on GitHub-hosted runners - #101
Conversation
GitHub-hosted minutes cost nothing on a public repository, so a pull request authored by dependabot[bot] now falls back to ubuntu-latest like a fork's. The expression tests pull_request.user.login rather than github.actor, which changes when someone re-runs or pushes. A push to main has no pull_request payload and stays on Ubicloud, so main still writes the cache. `tests/test_parent_runner_placement.py` gains a `dependabot` origin (hosted) and the parenthesised condition; new cases reject the fork-only form, an actor test and both hosted origins kept on Ubicloud.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Reviewer's GuideUpdates the validation workflow so Dependabot pull requests run on free GitHub-hosted runners in public repositories, using the stable pull-request author identity, while pushes and same-repository pull requests retain Ubicloud placement; the contract tests and developer documentation are updated to enforce and explain the policy. Sequence diagram for pull request runner selectionsequenceDiagram
participant GitHub
participant Workflow
participant Runner
GitHub->>Workflow: Trigger act-validation.yml
Workflow->>Workflow: Read pull_request.head.repo.fork
Workflow->>Workflow: Read pull_request.user.login
alt fork pull request or Dependabot author
Workflow->>Runner: runs-on ubuntu-latest
else push or same-repository pull request
Workflow->>Runner: runs-on ubicloud-standard-4
end
Flow diagram for validation runner placementflowchart TD
Start["Workflow event"] --> PR{"pull_request payload?"}
PR -->|No, push to main| U["Ubicloud runner\nubicloud-standard-4"]
PR -->|Yes| Fork{"head.repo.fork?"}
Fork -->|Yes| H["GitHub-hosted runner\ ubuntu-latest"]
Fork -->|No| Author{"user.login == dependabot[bot]?"}
Author -->|Yes| H
Author -->|No| U
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
Summary
ValidationThe author reports that WalkthroughThe validation workflow now selects ChangesRunner placement
Priority: ⬇️ Low Change: Feature Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Developer Documentation |  |
The PR changes the CI runner boundary: Dependabot pull requests now use ubuntu-latest, while pushes and same-repository pull requests use Ubicloud. docs/developers-guide.md documents the expressio… |
Add an ADR or a logged addendum to the relevant CI design ADR. Record the decision date, origin-to-runner mapping, use of pull_request.user.login instead of github.actor, the cache consequence, and the disk and timeout rationale. Link t… |
| Observability | |
The change alters runner placement and cache behaviour: Dependabot pull requests now use ubuntu-latest at .github/workflows/act-validation.yml:21-24, while pushes remain on Ubicloud. The workflow … |
Add bounded-cardinality telemetry at the runner-placement decision and job boundary. Record the selected runner pool (hosted or ubicloud), trigger origin (push, same-repository, fork, or dependabot), duration, and success/failur… |
-
Check name Status Explanation Title check The title clearly describes the main change: routing Dependabot pull requests to GitHub-hosted runners. No roadmap or GitHub issue number is required because the description does not identify one in t… Description check The description directly explains the runner-selection change, implementation details, documentation updates, tests, and validation results. Docstring Coverage Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 1 files. (2 skipped: 2 … Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Testing (Overall) The changed runner behaviour has substantive contract tests. test_the_estate_expression_places_each_runcovers push, same-repository, fork and Dependabot origins.test_a_misplaced_lane_is_reported…User-Facing Documentation PASS: The pull request changes the parent repository's act-validationCI runner placement only. It does not change generated-project functionality or a user-facing interface. The operational detail …Module-Level Documentation The changed Python module, tests/test_parent_runner_placement.py, has a module docstring. It states the module purpose, explains the placement utility, and describes the relationship to parent workf…Testing (Unit And Behavioural) The change adds meaningful placement coverage. tests/test_parent_runner_placement.pychecks push, same-repository, fork, and Dependabot origins. It rejects a missing Dependabot arm, actor-based dete…Testing (Property / Proof) PASS — Do not recommend a property-based test. The changed invariant has a small, complete table of meaningful origins: push and same-repository runs use ubicloud-standard-4, while fork and Dependab…Testing (Compile-Time / Ui) Mark this check PASS. The PR changes GitHub Actions YAML, Markdown, and Python tests. It introduces no Rust or TypeScript compile-time behaviour. The placement tests use focused semantic assertions fo… Unit Architecture The change only updates workflow configuration, documentation, and placement-contract tests. The new runner expression is declarative policy; it adds no query API, command implementation, external dep… Domain Architecture The pull request changes only GitHub Actions runner placement, developer documentation, and placement-contract tests. It does not change domain logic, commands, repositories, adapters, or domain-facin… Full details: Title check
-
Explanation
The title clearly describes the main change: routing Dependabot pull requests to GitHub-hosted runners. No roadmap or GitHub issue number is required because the description does not identify one in the required format.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 1 files. (2 skipped: 2 unsupported.)
Full details: Testing (Overall)
-
Explanation
The changed runner behaviour has substantive contract tests.
test_the_estate_expression_places_each_runcovers push, same-repository, fork and Dependabot origins.test_a_misplaced_lane_is_reportedrejects the fork-only expression,github.actor, inverted arms, always-hosted and always-Ubicloud variants.test_every_ubicloud_lane_is_placed_by_the_estate_expressionparses the actual workflow and checks the exact job, runner shape, origin placement and timeout. The tests therefore fail for the main plausible incorrect implementations and do not rely on mocks or vacuous assertions.
Full details: User-Facing Documentation
-
Explanation
PASS: The pull request changes the parent repository's
act-validationCI runner placement only. It does not change generated-project functionality or a user-facing interface. The operational detail is documented indocs/developers-guide.md, which matches the contributor audience;docs/users-guide.mdis not the applicable document.
Full details: Module-Level Documentation
-
Explanation
The changed Python module,
tests/test_parent_runner_placement.py, has a module docstring. It states the module purpose, explains the placement utility, and describes the relationship to parent workflows, fork pull requests, Dependabot pull requests, and the constructed-expression checks. The pull request only changes a workflow, documentation, and this already documented test module. No changed module lacks the required documentation.
Full details: Testing (Unit And Behavioural)
-
Explanation
The change adds meaningful placement coverage.
tests/test_parent_runner_placement.pychecks push, same-repository, fork, and Dependabot origins. It rejects a missing Dependabot arm, actor-based detection, inverted arms, wrong labels, literal runners, and non-string values. It also covers YAML errors, missing workflow directories, runner ceilings, and the exact inventory of real workflow files. The final contract test reads.github/workflows/act-validation.yml, so the tests exercise the workflow configuration boundary rather than only isolated helpers.
Full details: Testing (Property / Proof)
-
Explanation
PASS — Do not recommend a property-based test. The changed invariant has a small, complete table of meaningful origins: push and same-repository runs use
ubicloud-standard-4, while fork and Dependabot pull requests useubuntu-latest.tests/test_parent_runner_placement.pyparameterizes these four cases and adds focused negative cases for a missing Dependabot arm, actor-based detection, inverted arms, and non-estate expressions. The boolean condition and exact author comparison are auditable from this finite table; no introduced lemma or proof assumption requires exhaustive proof.
Full details: Testing (Compile-Time / Ui)
-
Explanation
Mark this check PASS. The PR changes GitHub Actions YAML, Markdown, and Python tests. It introduces no Rust or TypeScript compile-time behaviour. The placement tests use focused semantic assertions for push, same-repository, fork, and Dependabot origins, and reject the key incorrect expressions. No generated or UI-facing output requires a snapshot; snapshotting the runner expression would add brittle syntax coverage instead of behavioural coverage.
Full details: Unit Architecture
-
Explanation
The change only updates workflow configuration, documentation, and placement-contract tests. The new runner expression is declarative policy; it adds no query API, command implementation, external dependency, clock, network handle, mutable state, or hidden side-effect. The test additions keep parsing and runner selection as pure functions, with filesystem/YAML access confined to the existing workflow-loading boundary. No new unit is given multiple unrelated responsibilities, and the diff does not make fallibility or state mutation less visible.
Full details: Domain Architecture
-
Explanation
The pull request changes only GitHub Actions runner placement, developer documentation, and placement-contract tests. It does not change domain logic, commands, repositories, adapters, or domain-facing dependencies. No domain boundary violation or dishonest domain invariant claim is introduced.
-
Full details: Developer Documentation
-
Explanation
The PR changes the CI runner boundary: Dependabot pull requests now use
ubuntu-latest, while pushes and same-repository pull requests use Ubicloud.docs/developers-guide.mddocuments the expression and rationale, but the PR changes no design document or ADR. The repository records comparable CI decisions in ADRs, so the new runner-placement decision is not fully recorded.Resolution
Add an ADR or a logged addendum to the relevant CI design ADR. Record the decision date, origin-to-runner mapping, use of
pull_request.user.logininstead ofgithub.actor, the cache consequence, and the disk and timeout rationale. Link the record from the developer guide.
Full details: Observability
-
Explanation
The change alters runner placement and cache behaviour: Dependabot pull requests now use
ubuntu-latestat.github/workflows/act-validation.yml:21-24, while pushes remain on Ubicloud. The workflow has diagnostic artefact uploads, but it adds no bounded-cardinality metric or structured decision telemetry for runner pool, origin, cache path, duration, or failure outcome. Repository inspection found no existing metrics facility that covers this workflow. This prevents maintainers from measuring hosted-resource use, cold-cache impact, and degraded placement behaviour without inspecting individual runs.Resolution
Add bounded-cardinality telemetry at the runner-placement decision and job boundary. Record the selected runner pool (
hostedorubicloud), trigger origin (push,same-repository,fork, ordependabot), duration, and success/failure outcome. Publish a stable metric or equivalent retained workflow telemetry, and add a short diagnostic summary without raw actor names, tokens, request identifiers, or other personal data. Keep the existing Act diagnostic artefacts and verify the new telemetry for every placement branch.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Route forked pull requests to hosted ground
Let Dependabot follow that route
Check the author, not the rerun actor
Keep other cases on the Ubicloud runner
Test each branch and document the rule
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
A re-run keeps the original actor (triggering_actor names the re-runner); what flips the runner is another person pushing to a Dependabot branch.
Part of DF12-89
Rollout of the pattern in leynos/typos-config-builder#152 (reviewed and merged): Dependabot pull requests on a public repository run on GitHub-hosted runners, not Ubicloud. User decision of 19 October 2026.
Change
Every Ubicloud
runs-onthat has the fork fallback gains the Dependabot arm, in the pilot's shape:pull_request.user.login(the author), notgithub.actor, which changes on a re-run.mainhave nopull_requestpayload and stay on Ubicloud, so main's caches stay warm.tests/test_parent_runner_placement.pygains adependabotorigin (hosted) and the parenthesised condition; new cases reject the fork-only form, an actor test and both hosted origins kept on Ubicloud.docs/developers-guide.mdrecords the reason and the cold-cache consequence.Check script row (before)
["agent-template-python", "pending", "1 ubicloud jobs, 1 lacking the arm"]from~/docs/jm5-dependabot-runners/bin/check.pyonorigin/HEADbefore this change.Gates
make check-fmt,make lint,make test(193 passed, 2 skipped),mdtablefix --checkall clean.Mutation proof
act-validation.yml:user.loginreplaced byactor(all jobs)act-validation.yml: Dependabot arm removed (first job)tests/test_parent_runner_placement.py:s/"dependabot": HOSTED_LABEL/"dependabot": label/Merge class
Mechanical rollout of the pilot's shape (same expression, same form of contract change, docs paragraph, mutation proof), per the lead's ruling of 19 October.
Overlapping open PRs
These open PRs touch the same kind of files; per the standing rulings they do not hold this PR and are left untouched:
Summary by Sourcery
Route Dependabot pull requests to GitHub-hosted runners while preserving Ubicloud placement for other eligible runs.
New Features:
Enhancements:
Documentation:
Tests: