Repository navigation
Run Dependabot pull requests on GitHub-hosted runners - #932
Conversation
Reviewer's GuideThis PR rolls out the established runner-selection pattern across the pull-request lanes: forked and Dependabot pull requests use GitHub-hosted runners, while other executions retain their lane-specific Ubicloud runners. The workflow contract parser, fixtures, mutation tests, property coverage, and developer documentation are updated to enforce the exact author-based guard and explain its operational tradeoffs. Sequence diagram for pull request runner selectionsequenceDiagram
participant GitHub
participant Workflow as GitHub Actions workflow
participant Runner
GitHub->>Workflow: Start pull_request run
alt fork pull request
Workflow->>Runner: runs-on ubuntu-latest
else author is dependabot[bot]
Workflow->>Runner: runs-on ubuntu-latest
else other pull request
Workflow->>Runner: runs-on lane-specific Ubicloud runner
end
Flow diagram for push and pull request runner placementflowchart TD
A[Workflow run] --> B{Pull request context}
B -->|"Fork or author is dependabot[bot]"| C[GitHub-hosted ubuntu-latest]
B -->|Other pull request| D[Lane-specific Ubicloud runner]
B -->|Push to main| D
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
Summary
The author reports 1,321 workflow-contract tests passed and 3 were skipped. Ruff check and format, and WalkthroughWorkflow runner selection now uses hosted runners for pull requests from forks and pull requests authored by ChangesHosted runner fallback
Possibly related PRs
Suggested labels: Suggested reviewers: Priority: ⬇️ Low Change: Feature Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title "Run Dependabot pull requests on GitHub-hosted runners" matches the main change: the workflows and fork-fallback contract now route Dependabot pull requests to ubuntu-latest, while pushes st… |
| Docstring Coverage | |
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 16 functions across 5 files. (3 skipped: 3… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
| Testing (Overall) | |
Accept the testing coverage. The contract test reads all checked-in runner declarations and requires the exact `(github.event.pull_request.head.repo.fork || github.event.pull_request.user.login == 'de… |
| User-Facing Documentation | |
PASS: The pull request changes repository CI runner placement for Dependabot and fork pull requests. It does not change Netsuke functionality or behaviour for end users. The change is documented in th… |
| Developer Documentation | |
Pass. The pull request changes CI runner placement and documents the policy in docs/developers-guide.md at lines 1241-1263 and 1265-1311. The guide records the Dependabot condition, author-versus-ac… |
| Module-Level Documentation | |
All five changed Python modules have clear module-level docstrings. The docstrings state each module's purpose and use, and describe relationships where needed, including workflow readers, contract te… |
| Testing (Unit And Behavioural) | |
The PR adds adequate unit and workflow-contract coverage. fork_fallback_test.py reads the checked-in workflow YAML, verifies all direct runner declarations, checks the exact combined HOSTED_GUARD,… |
| Testing (Property / Proof) | |
PASS. Keep the Hypothesis property test in tests/workflow_contracts/runner_placement_properties_test.py:363-397. It ranges over all fork-fallback mutation kinds, including dependabot-arm-dropped a… |
| Testing (Compile-Time / Ui) | |
Pass. The pull request changes YAML workflows, Markdown, and Python contract tests only; it adds no Rust or TypeScript compile-time behaviour. The structured runner expressions have focused semantic c… |
| Unit Architecture | |
PASS — The pull request adds runner-selection expressions and pure workflow-contract parsing only. The workflow changes read explicit GitHub event fields and select a runner; they add no application q… |
| Domain Architecture | |
Pass this check. The pull request changes only GitHub Actions runner placement, workflow-contract tests, and documentation. It does not change domain logic, domain models, commands, repositories, or a… |
| Observability | |
PASS: The change alters GitHub Actions runner placement for Dependabot pull requests. It does not alter application or production service behaviour, process boundaries, request throughput, latency, re… |
| Description check | |
The description matches the changes: it explains routing fork and Dependabot pull requests to GitHub-hosted runners, keeping pushes on Ubicloud, and updating the workflow contracts, tests and document… |
Full details: Title check
-
Explanation
The title "Run Dependabot pull requests on GitHub-hosted runners" matches the main change: the workflows and fork-fallback contract now route Dependabot pull requests to ubuntu-latest, while pushes stay on Ubicloud. The title does not reference a roadmap item or issue number. The title-check requirements call for a roadmap or issue reference only where the description or execplan provides one. The description cites DF12-89, which is a tracker reference rather than a roadmap item number, so no change is required.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 16 functions across 5 files. (3 skipped: 3 unsupported.)
Full details: Testing (Overall)
-
Explanation
Accept the testing coverage. The contract test reads all checked-in runner declarations and requires the exact
(github.event.pull_request.head.repo.fork || github.event.pull_request.user.login == 'dependabot[bot]')guard, the correct hosted label, and the Ubicloud owned arm (d1b802d,tests/workflow_contracts/fork_fallback_test.py:47-65;.github/workflows/ci.yml:62-65,400-403;.github/workflows/netsukefile-test.yml:35-38). The mutation property test rejects both plausible regressions introduced by this change: dropping the Dependabot arm and usinggithub.actorinstead of the pull-request author. It also checks the exact offending lane, so the assertions are not vacuous (d1b802d,tests/workflow_contracts/runner_placement_mutations.py:270-286;runner_placement_properties_test.py:363-397).
Full details: User-Facing Documentation
-
Explanation
PASS: The pull request changes repository CI runner placement for Dependabot and fork pull requests. It does not change Netsuke functionality or behaviour for end users. The change is documented in the contributor-focused developers' guide, which describes the Dependabot guard, author-versus-actor choice, hosted runner, and push behaviour at
docs/developers-guide.md:1239-1263. The users' guide is an end-user reference for authoring and running Netsuke, as stated indocs/contents.md:295-297, so no users' guide update is required.
Full details: Developer Documentation
-
Explanation
Pass. The pull request changes CI runner placement and documents the policy in
docs/developers-guide.mdat lines 1241-1263 and 1265-1311. The guide records the Dependabot condition, author-versus-actor choice, push behaviour, lane-specific hosted runners, cache effects, and contract coverage. No new API, roadmap item, ExecPlan, or separate design document is introduced, and no additional locale requires synchronisation.
Full details: Module-Level Documentation
-
Explanation
All five changed Python modules have clear module-level docstrings. The docstrings state each module's purpose and use, and describe relationships where needed, including workflow readers, contract tests, mutation properties,
runner_placement_invariants, andsetup-rust. Evidence:tests/workflow_contracts/fork_fallback.py:1-27,fork_fallback_test.py:1-14,runner_placement_mutations.py:1-14,runner_placement_properties_test.py:1-9, andsetup_rust_sccache_test.py:1-21at the reviewed head.
Full details: Testing (Unit And Behavioural)
-
Explanation
The PR adds adequate unit and workflow-contract coverage.
fork_fallback_test.pyreads the checked-in workflow YAML, verifies all direct runner declarations, checks the exact combinedHOSTED_GUARD, and covers malformed declarations and line-break errors (lines 35-143). The mutation properties reject both a missing Dependabot arm and use ofgithub.actor, while preserving the valid declaration (runner_placement_mutations.py lines 270-326; runner_placement_properties_test.py lines 61-73 and 363-397). The tests therefore exercise the workflow contract boundary, not only private helpers. The changed workflows contain the author-based guard on all three affected lanes (ci.yml lines 62-65 and 400-403; netsukefile-test.yml lines 35-38).
Full details: Testing (Property / Proof)
-
Explanation
PASS. Keep the Hypothesis property test in
tests/workflow_contracts/runner_placement_properties_test.py:363-397. It ranges over all fork-fallback mutation kinds, includingdependabot-arm-droppedandactor-instead-of-author, and over all three affected lanes. The mutation helpers intests/workflow_contracts/runner_placement_mutations.py:270-333exercise the new invariant and the property asserts the exact offending lane. The invariant therefore has property coverage; no exhaustive proof is introduced or required.
Full details: Testing (Compile-Time / Ui)
-
Explanation
Pass. The pull request changes YAML workflows, Markdown, and Python contract tests only; it adds no Rust or TypeScript compile-time behaviour. The structured runner expressions have focused semantic coverage in
tests/workflow_contracts/fork_fallback_test.pyand mutation coverage for the missing Dependabot arm and incorrect actor intests/workflow_contracts/runner_placement_mutations.pyandrunner_placement_properties_test.py. This is configuration validation, not UI or generated text output, so snapshot tests are not appropriate.
Full details: Unit Architecture
-
Explanation
PASS — The pull request adds runner-selection expressions and pure workflow-contract parsing only. The workflow changes read explicit GitHub event fields and select a runner; they add no application query, command, I/O, network client, clock, global state, or hidden dependency.
fork_fallback.pykeeps parsing as a side-effect-free function with explicit string input andNoneoutput on unsupported input (repositoryleynos/netsuke, commit reviewed,tests/workflow_contracts/fork_fallback.py:137-190). The mutation helpers make their dictionary mutation explicit in their_apply_*_mutationnames and return types (same repository and commit,tests/workflow_contracts/runner_placement_mutations.py:230-285). The added cache expectation path delegates to the same pure parser and returns a value from its input (same repository and commit,tests/workflow_contracts/setup_rust_sccache_test.py:153-176). No changed unit combines unrelated responsibilities or makes fallibility or side-effects less visible.
Full details: Domain Architecture
-
Explanation
Pass this check. The pull request changes only GitHub Actions runner placement, workflow-contract tests, and documentation. It does not change domain logic, domain models, commands, repositories, or adapters. The new Dependabot condition remains in workflow infrastructure and the tests validate that infrastructure policy.
Full details: Observability
-
Explanation
PASS: The change alters GitHub Actions runner placement for Dependabot pull requests. It does not alter application or production service behaviour, process boundaries, request throughput, latency, retries, or production reliability. The workflows retain existing job status, cache, sccache, and resource summaries, and the developer guide documents the hosted-runner and cold-cache behaviour. No new production metrics, tracing, alerts, or logging are required by this observability check.
Full details: Description check
-
Explanation
The description matches the changes: it explains routing fork and Dependabot pull requests to GitHub-hosted runners, keeping pushes on Ubicloud, and updating the workflow contracts, tests and documentation.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Route forked runs to hosted ground.
Send Dependabot-authored runs there too.
Keep other events on their usual runners.
Check each guard against its contract.
Let clear examples show the path.
Comment @coderabbitai help to get the list of available commands.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
GitHub-hosted minutes cost nothing on a public repository, so a pull request authored by dependabot[bot] now falls back to ubuntu-latest like a fork's. The expression tests pull_request.user.login rather than github.actor, which changes when someone re-runs or pushes. A push to main has no pull_request payload and stays on Ubicloud, so main still writes the cache. `fork_fallback.py` reads the combined guard (`HOSTED_GUARD`) and requires it on the three pull-request lanes; the mutation table the property tests draw from gains `dependabot-arm-dropped` and `actor-instead-of-author`. Netsuke is a heavy repository: the measured Dependabot run on `ubuntu-latest` follows after merge. Bespoke contract, so this PR takes the full review gate.
d1b802d to
2728195
Compare
|
Rebased onto main only because the squash merge of a branch whose workflow file diverged from main needs the |
Part of DF12-89
Rollout of the pattern in leynos/typos-config-builder#152 (reviewed and merged): Dependabot pull requests on a public repository run on GitHub-hosted runners, not Ubicloud. User decision of 19 October 2026.
Change
Every Ubicloud
runs-onthat has the fork fallback gains the Dependabot arm, in the pilot's shape:pull_request.user.login(the author), notgithub.actor, which changes on a re-run.mainhave nopull_requestpayload and stay on Ubicloud, so main's caches stay warm.fork_fallback.pyreads the combined guard (HOSTED_GUARD) and requires it on the three pull-request lanes; the mutation table the property tests draw from gainsdependabot-arm-droppedandactor-instead-of-author. Netsuke is a heavy repository: the measured Dependabot run onubuntu-latestfollows after merge. Bespoke contract, so this PR takes the full review gate.docs/developers-guide.mdrecords the reason and the cold-cache consequence.Check script row (before)
["netsuke", "pending", "4 ubicloud jobs, 3 lacking the arm"]from~/docs/jm5-dependabot-runners/bin/check.pyonorigin/HEADbefore this change.Gates
pytest tests/workflow_contracts --doctest-modulesasmake test-workflow-contractsruns it (1321 passed, 3 skipped),ruff@0.16.4check and format clean,mdtablefix --checkclean.Mutation proof
ci.yml:user.loginreplaced byactor(all jobs)ci.yml: Dependabot arm removed (first job)netsukefile-test.yml:user.loginreplaced byactor(all jobs)netsukefile-test.yml: Dependabot arm removed (first job)tests/workflow_contracts/fork_fallback.py:and placement.guard == HOSTED_GUARD->and placement.guard == FORK_GUARDMerge class
Mechanical rollout of the pilot's shape (same expression, same form of contract change, docs paragraph, mutation proof), per the lead's ruling of 19 October.
Overlapping open PRs
These open PRs touch the same kind of files; per the standing rulings they do not hold this PR and are left untouched:
netsuke-buildthrough crates.io Trusted Publishing #903 (use-trusted-packaging)Summary by Sourcery
Route fork and Dependabot pull requests to GitHub-hosted runners while keeping push workflows on Ubicloud.
New Features:
Enhancements:
Tests:
Selector proof
Selector proof: natural Dependabot runs on ubuntu-latest, all green: https://github.com/leynos/actix-v2a/actions/runs/39958329992, https://github.com/leynos/typos-config-builder/actions/runs/39990740324, https://github.com/leynos/agentland/actions/runs/39965006591; and a main push staying on ubicloud-standard-2: https://github.com/leynos/typos-config-builder/actions/runs/39181228629.