Repository navigation
Place Dependabot pull requests on hosted runners for the default-features lane - #949
Conversation
Reviewer's guide (collapsed on small PRs)Reviewer's GuideUpdates the default-features CI lane to use GitHub-hosted runners for Dependabot and fork pull requests, while retaining Ubicloud runners for eligible pull requests and documenting the routing rationale. Flow diagram for default-features runner selectionflowchart TD
PR[Pull request] --> Check{Fork or Dependabot author?}
Check -->|Yes| Hosted[GitHub-hosted runner: ubuntu-latest]
Check -->|No| Ubicloud[Ubicloud runner: ubicloud-standard-4-ubuntu-2404]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Default-features runner condition .github/workflows/ci-default-features.yml |
The runner condition sends fork pull requests and pull requests authored by dependabot[bot] to ubuntu-latest. Other pull requests use the Ubicloud runner. |
Possibly related issues
leynos/pg-embed-setup-unpriv#358— The issue describes the same need for GitHub-hosted runners for Dependabot pull requests.
Possibly related PRs
- leynos/netsuke#932 — This PR applies the same Dependabot runner condition to other CI lanes in this repository.
- leynos/falcon-pachinko#249 — This PR adds the same Dependabot author check to a fork-aware runner condition.
- leynos/vk#335 — This PR uses the same fork-or-Dependabot runner policy.
Suggested reviewers: codescene-access
Priority:
Change: Bug fix
Merge Risk: 
83325
-
The runner-selection change is narrowly scoped and presents no identified merge-blocking risk.
Caution
Pre-merge checks failed
Please resolve all errors before merging. Addressing warnings is optional.
- Ignore
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Testing (Overall) |  |
The pull request changes runner selection for Dependabot pull requests in .github/workflows/ci-default-features.yml (lines 45-51), but it adds no test. The existing fork-placement contract checks on… |
Add a workflow-contract test that loads .github/workflows/ci-default-features.yml, selects the default-features job, and asserts its runs-on expression uses the exact hosted guard `github.event.pull_request.head.repo.fork || github.ev… |
| Testing (Unit And Behavioural) | |
The pull request changes the externally observable runs-on behaviour in .github/workflows/ci-default-features.yml, but it adds no test. Existing workflow-contract tests do not cover this job's run… |
Add a workflow-contract or end-to-end test that loads ci-default-features.yml and verifies the default-features job selects ubuntu-latest for fork and Dependabot pull requests, and ubicloud-standard-4-ubuntu-2404 otherwise. Include … |
-
Check name Status Explanation Title check The title states the main change: Dependabot pull requests are moved to hosted runners for the default-features lane. This matches the raw summary, the description and the objectives. The title does n… Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. User-Facing Documentation PASS — The pull request changes only CI runner selection in .github/workflows/ci-default-features.yml. It does not add or change user-facing functionality, an API, a CLI, or application behaviour. N…Developer Documentation PASS — The pull request changes only the runs-onexpression and its rationale comment in.github/workflows/ci-default-features.yml(lines 45–51). It adds no internal API, architectural boundary, a…Module-Level Documentation Pass the module-level documentation check. The pull request changes only .github/workflows/ci-default-features.yml, a workflow configuration file, and adds a runner expression plus comments. It intr…Testing (Property / Proof) PASS — The PR adds one boolean routing condition to .github/workflows/ci-default-features.yml: fork OR Dependabot selectsubuntu-latest; otherwise it selects the Ubicloud runner. This invariant ha…Testing (Compile-Time / Ui) Pass this check. The pull request changes only .github/workflows/ci-default-features.yml: it adds a Dependabot condition toruns-onand updates a comment. It introduces no Rust or TypeScript compi…Unit Architecture PASS. The pull request changes only .github/workflows/ci-default-features.yml. It extends the existingruns-onselection so Dependabot pull requests useubuntu-latest(lines 43-51). This is work…Domain Architecture PASS. The pull request changes only the GitHub Actions runner selection and its comment in .github/workflows/ci-default-features.yml(lines 43–51). It does not change domain code, adapters, reposito…Observability The change only routes the existing default-featuresCI job toubuntu-latestfor Dependabot pull requests. It does not change application runtime behaviour or add a service, queue, storage, or net…Description check The description states the change is a follow-up to PR #932that adds the Dependabot arm to the default-features job's runs-on expression in ci-default-features.yml, matching the raw summary. It also …Full details: Title check
-
Explanation
The title states the main change: Dependabot pull requests are moved to hosted runners for the default-features lane. This matches the raw summary, the description and the objectives. The title does not reference a roadmap item or an issue number. The title requirements do not mandate either, because the PR description cites a tracker key (DF12-89) and a related PR (
#932) rather than a roadmap number or a GitHub issue that the PR fixes.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Full details: User-Facing Documentation
-
Explanation
PASS — The pull request changes only CI runner selection in
.github/workflows/ci-default-features.yml. It does not add or change user-facing functionality, an API, a CLI, or application behaviour. No user-guide or migration documentation is required by this check.
Full details: Developer Documentation
-
Explanation
PASS — The pull request changes only the
runs-onexpression and its rationale comment in.github/workflows/ci-default-features.yml(lines 45–51). It adds no internal API, architectural boundary, abstraction, design decision, or new build/tool requirement. The change follows the existing Dependabot runner pattern inci.ymlandnetsukefile-test.yml; no developer-guide or ADR update is required.
Full details: Module-Level Documentation
-
Explanation
Pass the module-level documentation check. The pull request changes only
.github/workflows/ci-default-features.yml, a workflow configuration file, and adds a runner expression plus comments. It introduces no module.
Full details: Testing (Property / Proof)
-
Explanation
PASS — The PR adds one boolean routing condition to
.github/workflows/ci-default-features.yml: fork OR Dependabot selectsubuntu-latest; otherwise it selects the Ubicloud runner. This invariant has two predicates and a small, complete truth table that a reader can audit directly. The change introduces no broad input/state space, lemma, or proof assumption. The custom check does not require a property test for this change.
Full details: Testing (Compile-Time / Ui)
-
Explanation
Pass this check. The pull request changes only
.github/workflows/ci-default-features.yml: it adds a Dependabot condition toruns-onand updates a comment. It introduces no Rust or TypeScript compile-time behaviour, structured output, or UI output. The trybuild and snapshot requirements therefore do not apply.
Full details: Unit Architecture
-
Explanation
PASS. The pull request changes only
.github/workflows/ci-default-features.yml. It extends the existingruns-onselection so Dependabot pull requests useubuntu-latest(lines 43-51). This is workflow routing, not a query, command, fallible operation, dependency, or domain unit. It introduces no hidden state, side-effect, client, clock, or persistence boundary. The expression matches the established pattern in.github/workflows/ci.yml(lines 54-66). No Unit Architecture failure condition is introduced.
Full details: Domain Architecture
-
Explanation
PASS. The pull request changes only the GitHub Actions runner selection and its comment in
.github/workflows/ci-default-features.yml(lines 43–51). It does not change domain code, adapters, repositories, commands, or business rules. The Domain Architecture failure conditions are therefore not applicable.
Full details: Observability
-
Explanation
The change only routes the existing
default-featuresCI job toubuntu-latestfor Dependabot pull requests. It does not change application runtime behaviour or add a service, queue, storage, or network operation. GitHub Actions already exposes the job status, step logs, timeout, and runner selection, and the new comment documents the decision and its author-based condition. No new logging, metric, trace, or alert is required by this change.
Full details: Description check
-
Explanation
The description states the change is a follow-up to PR
#932that adds the Dependabot arm to the default-features job's runs-on expression in ci-default-features.yml, matching the raw summary. It also names the runner contract inventory and includes mutation test results, all of which relate to the changeset. The description is specific and on-topic, so the check passes.
-
Full details: Testing (Overall)
-
Explanation
The pull request changes runner selection for Dependabot pull requests in
.github/workflows/ci-default-features.yml(lines 45-51), but it adds no test. The existing fork-placement contract checks onlyDIRECT_RUNNER_SOURCESintests/workflow_contracts/runner_placement_test.py(lines 37-57), which excludesci-default-features.yml. ItsFORK_FALLBACK_RUNNERSmapping also excludes this lane (tests/workflow_contracts/fork_fallback.py, lines 232-240). The default-features tests check workflow inputs and Make targets, notruns-on(tests/workflow_contracts/ci_default_features_test.py, lines 121-143). Therefore, reverting the Dependabot arm for this job would still pass the existing tests.Resolution
Add a workflow-contract test that loads
.github/workflows/ci-default-features.yml, selects thedefault-featuresjob, and asserts itsruns-onexpression uses the exact hosted guardgithub.event.pull_request.head.repo.fork || github.event.pull_request.user.login == 'dependabot[bot]', selectsubuntu-latestfor that arm, and retains the Ubicloud runner for repository-owned runs. Add the lane to the relevant checked-in runner inventory and mutation/property coverage so removal, inversion, or incorrect replacement of the Dependabot arm fails.
Full details: Testing (Unit And Behavioural)
-
Explanation
The pull request changes the externally observable
runs-onbehaviour in.github/workflows/ci-default-features.yml, but it adds no test. Existing workflow-contract tests do not cover this job's runner expression:DIRECT_RUNNER_SOURCESexcludesci-default-features.yml, andci_default_features_test.pychecks workflow inputs and build steps only.Resolution
Add a workflow-contract or end-to-end test that loads
ci-default-features.ymland verifies thedefault-featuresjob selectsubuntu-latestfor fork and Dependabot pull requests, andubicloud-standard-4-ubuntu-2404otherwise. Include checks for the author guard and the existing fork guard.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Route fork pull requests to hosted ground
Send Dependabot there, too
Keep other jobs on Ubicloud
Let the runner condition choose
Check the workflow, then send it through
Comment @coderabbitai help to get the list of available commands.
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
@coderabbitai At the current head the |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain
The property suite includes Distinguish this assessment from the displayed check state. The posted table still shows the earlier failures; this reply does not update that table or change approval status. I inspected the source but did not run the tests. The 1,305 passed, 2 skipped result remains author-reported. You are interacting with an AI system. |
Part of DF12-89
Follow-up to #932:
ci-default-features.ymlwas added after that PR was written, and itsdefault-featuresjob still carried the fork-only expression. It gains the Dependabot arm in the pilot's shape (runs-onand its rationale comment only). The check script reported it as the one netsuke job lacking the arm. The lane is now inventoried in the runner contracts (REQUIRED_RUNNER_ASSIGNMENTS,FORK_FALLBACK_RUNNERS,DIRECT_RUNNER_SOURCES):pytest tests/workflow_contracts1305 passed, 2 skipped. Mechanical rollout of the merged pattern.Mutation proof
ci-default-features.yml:user.loginreplaced byactor(all jobs)ci-default-features.yml: Dependabot arm removed (first job)ci.yml:user.loginreplaced byactor(all jobs)ci.yml: Dependabot arm removed (first job)netsukefile-test.yml:user.loginreplaced byactor(all jobs)netsukefile-test.yml: Dependabot arm removed (first job)