Repository navigation
Run Dependabot pull requests on GitHub-hosted runners - #646
Conversation
Reviewer's GuideThe PR mechanically rolls out the established fork-runner pattern so Dependabot pull requests use Sequence diagram for Dependabot runner and coverage cache selectionsequenceDiagram
participant GitHub
participant Workflow
participant Coverage
participant Cache
GitHub->>Workflow: pull_request event
Workflow->>Workflow: github.event.pull_request.user.login
alt fork or Dependabot author
Workflow->>Workflow: select ubuntu-latest
Workflow->>Coverage: skip export-ubicloud-cache-credentials
Coverage->>Cache: use backend local
Cache-->>Coverage: compile cold
else owned pull request
Workflow->>Workflow: select ubicloud-standard-2
Workflow->>Coverage: run export-ubicloud-cache-credentials
Coverage->>Cache: use backend gha
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
Summary
ValidationThe author reports 795 tests passed, 49 fixture errors because WalkthroughCI runner conditions now send fork and Dependabot pull requests to ChangesPull-request runner placement and cache handling
Suggested labels: Priority: ⬇️ Low Change: Feature Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Testing (Unit And Behavioural) |  |
Add behavioural coverage for the new Dependabot runner path. The PR adds static YAML and parser checks, but it does not exercise the externally observable workflow selection for a Dependabot pull requ… | Add a Dependabot event fixture with a non-fork pull request and user.login == 'dependabot[bot]'. Update the event evaluator to resolve the combined fork-or-author expression. Add a behavioural scenario that reads the real composed workflo… |
| Testing (Property / Proof) |  |
The change adds a generic hosted-expression parser and a positional invariant over two references, two runner arms, and variable whitespace (tests/helpers/ci_placement.py:92-99,249-259). The new exa… |
Add a Hypothesis property in tests/test_ci_placement_properties.py for the combined expression. Generate valid fork and author references, both arm labels, and inner whitespace. Assert that parsing preserves the fork arm, owned arm, and b… |
-
Check name Status Explanation Title check The title "Run Dependabot pull requests on GitHub-hosted runners" matches the main change: the diff routes Dependabot-authored pull requests to ubuntu-latest in build-wheels.yml and ci.yml, alongside … Docstring Coverage Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 12 functions across 7 files. (4 skipped: 4… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Testing (Overall) Accept the testing coverage. The changed runner declarations are guarded by test_fork_reachable_lanes_fall_back_by_position, which checks the hosted and Ubicloud arms and requires bothFORK_FIELD…User-Facing Documentation The pull request changes internal GitHub Actions runner placement and cache handling for Dependabot pull requests. It does not change Cuprum's user-facing Python or Rust API. The authoritative diff ha… Developer Documentation Pass. The CI tooling and runner-placement change is documented in docs/developers-guide.md: the fork-arm section records the Dependabot condition, the author-versus-actor rule, thecoveragecreden…Module-Level Documentation All seven modified Python modules retain module-level docstrings in the reviewed head. The docstrings describe each module's purpose and testing or helper role, with component relationships stated whe… Testing (Compile-Time / Ui) PASS. The reviewed range changes YAML workflows, Python contract tests/helpers, and Markdown only. It adds no Rust or TypeScript compile-time behaviour, so a trybuild or equivalent test is not applica… Unit Architecture Pass this check. The pull request changes only GitHub Actions expressions, documentation, and test contracts. The new _conditional_placementfunction intests/helpers/ci_placement.pyis a pure par…Domain Architecture PASS: The pull request changes only CI workflow expressions, CI contract tests and helpers, and CI documentation. The reviewed diff has no production domain code or domain boundary changes. Therefore,… Observability Pass this check. The change only alters GitHub Actions runner and cache routing. GitHub exposes the selected runner on each job, while the affected CI jobs already record cache keys and hit status in … Description check Pass the description check. The description directly explains the Dependabot runner changes, cache handling, contract tests, documentation updates, and validation results. Full details: Title check
-
Explanation
The title "Run Dependabot pull requests on GitHub-hosted runners" matches the main change: the diff routes Dependabot-authored pull requests to ubuntu-latest in build-wheels.yml and ci.yml, alongside fork pull requests. The title does not include a roadmap item or issue number, but the description references DF12-89, and the requirements only mandate those references where a roadmap task or issue is referenced in the PR description; this is a judgement call that the author should confirm.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 12 functions across 7 files. (4 skipped: 4 unsupported.)
Full details: Testing (Overall)
-
Explanation
Accept the testing coverage. The changed runner declarations are guarded by
test_fork_reachable_lanes_fall_back_by_position, which checks the hosted and Ubicloud arms and requires bothFORK_FIELDandAUTHOR_FIELDfor every affected job (tests/test_ci_runner_placement.py:66-96). Synthetic reader tests exercise the combined expression and distinguishgithub.event.pull_request.user.loginfromgithub.actor(tests/test_ci_placement_reader.py:106-130). Cache tests require the combined condition for both thelocal/ghabackend choice and the credentials-step guard (tests/test_ci_compiler_cache_backend.py:138-155,221-242). The benchmark-gate contract also asserts the completechangesrunner expression (cuprum/unittests/test_benchmark_gate_ci_contract.py:149-171). These assertions fail for the main plausible regressions: fork-only logic, actor-based logic, swapped runner arms, missing Dependabot cache handling, and an incorrect benchmark-gate expression.
Full details: User-Facing Documentation
-
Explanation
The pull request changes internal GitHub Actions runner placement and cache handling for Dependabot pull requests. It does not change Cuprum's user-facing Python or Rust API. The authoritative diff has no change to
docs/users-guide.md; that guide targets package users and documents command execution and installation (docs/users-guide.md:1-14). The relevant maintainer-facing behaviour is documented indocs/developers-guide.md, including the Dependabot hosted-runner condition and coverage cache behaviour. Therefore the user-facing documentation requirement does not apply.
Full details: Developer Documentation
-
Explanation
Pass. The CI tooling and runner-placement change is documented in
docs/developers-guide.md: the fork-arm section records the Dependabot condition, the author-versus-actor rule, thecoveragecredentials and sccache effects, and the cold-cache consequence (lines 181-226). The cache design document records the corresponding fork-or-Dependabot cache behaviour (docs/ci-cache-ownership.md, lines 178-182). No roadmap item or new execplan is changed in the reviewed range. The operational decision is therefore recorded in the relevant maintainer and cache design documentation.
Full details: Module-Level Documentation
-
Explanation
All seven modified Python modules retain module-level docstrings in the reviewed head. The docstrings describe each module's purpose and testing or helper role, with component relationships stated where needed, for example in
tests/helpers/ci_placement.pyandtests/test_ci_runner_placement.py. No changed file introduces a module without the required documentation.
Full details: Testing (Compile-Time / Ui)
-
Explanation
PASS. The reviewed range changes YAML workflows, Python contract tests/helpers, and Markdown only. It adds no Rust or TypeScript compile-time behaviour, so a trybuild or equivalent test is not applicable. The structured CI expression is covered with focused semantic assertions:
tests/test_ci_placement_reader.py:108-130checks both condition references, runner arms, and actor rejection;tests/helpers/ci_placement.py:249-269parses the supported variants; and the benchmark contract checks the exact normalised expression. This is a source-level CI contract, not user-facing or UI output, so a snapshot would add brittleness without improving coverage.
Full details: Unit Architecture
-
Explanation
Pass this check. The pull request changes only GitHub Actions expressions, documentation, and test contracts. The new
_conditional_placementfunction intests/helpers/ci_placement.pyis a pure parser with explicit input and output. It adds no I/O, network calls, clock access, process execution, mutation, or hidden dependency. Existing workflow reading remains at theplacementboundary. The updated tests use existing injected monkeypatch seams and add no side effects. No production Python, Rust, or configuration entity gains a mixed responsibility.
Full details: Domain Architecture
-
Explanation
PASS: The pull request changes only CI workflow expressions, CI contract tests and helpers, and CI documentation. The reviewed diff has no production domain code or domain boundary changes. Therefore, it does not introduce a Domain Architecture failure.
Full details: Observability
-
Explanation
Pass this check. The change only alters GitHub Actions runner and cache routing. GitHub exposes the selected runner on each job, while the affected CI jobs already record cache keys and hit status in GITHUB_STEP_SUMMARY and publish sccache effectiveness statistics. The resource sampler also records peak memory and disk use. The workflow comments and updated documentation state the expected Dependabot hosted-runner and cold-cache behaviour. No new service boundary, production data path, alert, or unbounded metric label was introduced.
-
Full details: Testing (Unit And Behavioural)
-
Explanation
Add behavioural coverage for the new Dependabot runner path. The PR adds static YAML and parser checks, but it does not exercise the externally observable workflow selection for a Dependabot pull request.
tests/helpers/ci_events.py:141-142selects the hosted arm only fromevent["fork"], andtests/features/ci_runner_selection.feature:11-53has no Dependabot event. Therefore the newgithub.event.pull_request.user.login == 'dependabot[bot]'branch in.github/workflows/ci.yml:76-77andbuild-wheels.yml:173-174can be wrong while the new tests still pass.Resolution
Add a Dependabot event fixture with a non-fork pull request and
user.login == 'dependabot[bot]'. Update the event evaluator to resolve the combined fork-or-author expression. Add a behavioural scenario that reads the real composed workflows, including the reusable wheel workflow, and asserts that every fork-reachable job selectsubuntu-latest. Exercise the coverage credentials guard and cache backend at the workflow boundary as well, asserting that Dependabot skips Ubicloud credentials and selects the local backend.
Full details: Testing (Property / Proof)
-
Explanation
The change adds a generic hosted-expression parser and a positional invariant over two references, two runner arms, and variable whitespace (
tests/helpers/ci_placement.py:92-99,249-259). The new example tests cover one canonical expression and onegithub.actormutation (tests/test_ci_placement_reader.py:108-131). The existing Hypothesis property covers only the fork-only grammar (tests/test_ci_placement_properties.py:95-125), so it does not exercise the new grammar across meaningful fields, labels, spacing, and arm orderings.Resolution
Add a Hypothesis property in
tests/test_ci_placement_properties.pyfor the combined expression. Generate valid fork and author references, both arm labels, and inner whitespace. Assert that parsing preserves the fork arm, owned arm, and both references by position. Add cases that verify the exactdependabot[bot]literal and reject or distinguishgithub.actor.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Route the pull requests to hosted ground
Keep Ubicloud runners for other rounds
Let cache credentials stay away
Choose local sccache for the day
Check each condition on its way
Comment @coderabbitai help to get the list of available commands.
GitHub-hosted minutes cost nothing on a public repository, so a pull request authored by dependabot[bot] now falls back to ubuntu-latest like a fork's. The expression tests pull_request.user.login rather than github.actor, which changes when someone re-runs or pushes. A push to main has no pull_request payload and stays on Ubicloud, so main still writes the cache. Besides `runs-on`, the `coverage` lane's sccache credentials-step guard and `backend` input were keyed on the fork field alone, so a Dependabot pull request on the hosted arm would have tried the Ubicloud cache proxy and failed closed; both now carry the combined condition. `tests/helpers/ci_placement.py` reads the combined expression (references: the fork and author fields), `test_ci_runner_placement.py` and `test_ci_compiler_cache_backend.py` require it, `test_ci_placement_reader.py` gains positive and actor-stand-in cases, and `test_ci_harness_boundary.py` no longer mistakes the `'dependabot[bot]'` operand for a runner label. Bespoke contract, so this PR takes the full review gate.
1f488f4 to
19f2110
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4da3a8e661
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
@coderabbitai The latest pre-merge table shows an error row (Testing (Unit And Behavioural)) asking for a workflow-level end-to-end test. Please assess this argument and say whether the error row is cleared at the current head. GitHub Actions evaluates |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
git rev-parse HEAD
fd -H '^(AGENTS\.md|ci_placement\.py|test_ci_runner_placement\.py|test_ci_compiler_cache_backend\.py|test_ci_placement_reader\.py)$' .
for f in tests/helpers/ci_placement.py tests/test_ci_runner_placement.py tests/test_ci_compiler_cache_backend.py tests/test_ci_placement_reader.py; do
ast-grep outline "$f"
done
gh pr view 646 --repo leynos/cuprum --json headRefOid,body,statusCheckRollup
gh api repos/leynos/cuprum/issues/646/comments --paginate --jq '.[] | {id,user:.user.login,body}'
gh pr view 152 --repo leynos/typos-config-builder --json body,state,mergedAt,commentsLength of output: 94599 🏁 Script executed: #!/bin/bash
cat AGENTS.md
sed -n '40,135p' tests/helpers/ci_placement.py
sed -n '245,335p' tests/helpers/ci_placement.py
sed -n '50,145p' tests/test_ci_runner_placement.py
sed -n '20,32p' tests/test_ci_placement_reader.py
sed -n '105,147p' tests/test_ci_placement_reader.py
sed -n '35,110p' tests/test_ci_compiler_cache_backend.py
sed -n '135,260p' tests/test_ci_compiler_cache_backend.py
ast-grep outline tests/helpers/ci_events.py
sed -n '1,210p' tests/helpers/ci_events.py
cat tests/features/ci_runner_selection.feature
rg -n -C 4 'runs-on:|dependabot|export-ubicloud-cache-credentials|backend:' .github/workflows/ci.yml .github/workflows/build-wheels.yml
git diff 4da3a8e661004faf4ea91a900e8ecb906f57c1b1 HEAD --stat
gh api repos/leynos/typos-config-builder/issues/152/comments --paginate --jq '.[] | select(.body | test("actions/runs/")) | {html_url,body}'Length of output: 72058 🤖 web_search executed:
Length of output: 16225
The current table requests a Dependabot event fixture and a scenario through the existing composed-workflow evaluator. It does not require a paid GitHub Actions job. The source inspection confirms two separate facts:
Correct one premise: GitHub evaluates runner selection before routing the job, not on a GitHub-hosted runner. See the GitHub contexts documentation. A local test cannot prove GitHub’s implementation, but it can exercise the repository’s event model against the checked-in composed workflows. Close the remaining gap without adding a proof workflow:
Keep live-run evidence separate. The retrieved pilot discussion accepts contract coverage and describes the real runs as pending post-merge validation. I found no linked completed selector runs in its comments, so I cannot confirm that part of the argument. This is a source-based assessment, not a test execution result. It does not change the displayed table or the PR’s approval status. You are interacting with an AI system. |
|
@coderabbitai Following your assessment, the existing behavioural model now has a Dependabot event: |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
git rev-parse HEAD
gh pr view 646 --repo leynos/cuprum --json headRefOid
fd -H '^AGENTS\.md$' .
cat AGENTS.md
for f in tests/helpers/ci_events.py tests/features/ci_runner_selection.feature tests/test_ci_compiler_cache_backend.py; do
ast-grep outline "$f"
done
rg -n -C 3 'DEPENDABOT_PULL_REQUEST|ci_runner_selection\.feature|Dependabot.s pull request selects only hosted runners|schedulable|dependabot' tests --glob '*.py' --glob '*.feature'Length of output: 50923 🏁 Script executed: #!/bin/bash
ast-grep outline tests/behaviour/test_ci_runner_selection.py
sed -n '1,210p' tests/helpers/ci_events.py
cat tests/features/ci_runner_selection.feature
sed -n '1,190p' tests/behaviour/test_ci_runner_selection.py
sed -n '260,320p' tests/behaviour/test_ci_runner_selection.py
sed -n '15,105p' tests/test_ci_compiler_cache_backend.py
sed -n '135,260p' tests/test_ci_compiler_cache_backend.py
rg -n -C 3 'runs-on:|dependabot|export-ubicloud-cache-credentials|backend:' .github/workflows/ci.yml .github/workflows/build-wheels.ymlLength of output: 39391 🏁 Script executed: #!/bin/bash
sed -n '190,223p' tests/behaviour/test_ci_runner_selection.py
git rev-parse HEADLength of output: 1738
Keep this verdict separate from test execution and PR approval. I did not run repository tests or reproduce the reported mutation check. This reply does not update the displayed table or change the provider’s approval status. No self-dispatching proof workflow is needed to close this finding. You are interacting with an AI system. |
Part of DF12-89
Rollout of the pattern in leynos/typos-config-builder#152 (reviewed and merged): Dependabot pull requests on a public repository run on GitHub-hosted runners, not Ubicloud. User decision of 19 October 2026.
Change
Every Ubicloud
runs-onthat has the fork fallback gains the Dependabot arm, in the pilot's shape:pull_request.user.login(the author), notgithub.actor, which changes on a re-run.mainhave nopull_requestpayload and stay on Ubicloud, so main's caches stay warm.runs-on, thecoveragelane's sccache credentials-step guard andbackendinput were keyed on the fork field alone, so a Dependabot pull request on the hosted arm would have tried the Ubicloud cache proxy and failed closed; both now carry the combined condition.tests/helpers/ci_placement.pyreads the combined expression (references: the fork and author fields),test_ci_runner_placement.pyandtest_ci_compiler_cache_backend.pyrequire it,test_ci_placement_reader.pygains positive and actor-stand-in cases, andtest_ci_harness_boundary.pyno longer mistakes the'dependabot[bot]'operand for a runner label. Bespoke contract, so this PR takes the full review gate.docs/developers-guide.mdrecords the reason and the cold-cache consequence.Check script row (before)
["cuprum", "pending", "8 ubicloud jobs, 7 lacking the arm"]from~/docs/jm5-dependabot-runners/bin/check.pyonorigin/HEADbefore this change.Gates
Focused:
pytest tests/test_ci_*.py tests/test_*workflow*.pywith--noconftest(795 passed; the 49 errors aretest_ci_setup_sccache_server_startfixtures that need a built sccache and the 1 failure found was fixed here),yamllint --strictandruff@0.16.4check/format on the changed tests clean,mdtablefix --checkclean.Mutation proof
build-wheels.yml:user.loginreplaced byactor(all jobs)build-wheels.yml: Dependabot arm removed (first job)ci.yml:user.loginreplaced byactor(all jobs)ci.yml: Dependabot arm removed (first job)tests/helpers/ci_placement.py:frozenset({hosted.group("fork_ref"), hosted.group("author_ref")})->frozenset({hosted.group("fork_ref")})Merge class
Mechanical rollout of the pilot's shape (same expression, same form of contract change, docs paragraph, mutation proof), per the lead's ruling of 19 October.
Overlapping open PRs
These open PRs touch the same kind of files; per the standing rulings they do not hold this PR and are left untouched:
Summary by Sourcery
Run Dependabot pull requests on GitHub-hosted runners while preserving consistent cache handling and CI placement contracts.
New Features:
Bug Fixes:
Enhancements:
Documentation:
Tests:
Selector proof
Selector proof: natural Dependabot runs on ubuntu-latest, all green: https://github.com/leynos/actix-v2a/actions/runs/39958329992, https://github.com/leynos/typos-config-builder/actions/runs/39990740324, https://github.com/leynos/agentland/actions/runs/39965006591; and a main push staying on ubicloud-standard-2: https://github.com/leynos/typos-config-builder/actions/runs/39181228629.