Repository navigation
Run Dependabot pull requests on GitHub-hosted runners - #646
Conversation
GitHub-hosted minutes cost nothing on a public repository, so a pull request authored by dependabot[bot] now falls back to ubuntu-latest like a fork's. The expression tests pull_request.user.login rather than github.actor, which changes when someone re-runs or pushes. A push to main has no pull_request payload and stays on Ubicloud, so main still writes the cache. Every Ubicloud lane that had the fork fallback gains the Dependabot arm (workflow `runs-on` lines, plus the `runner:`/`os:` matrix keys in `ci.yml`, `rust-toy-app.yml` and the `test-install-*` and `test-setup-rust-mold` workflows). The two `test-ubicloud-sccache-proxy.yml` jobs carry a `dependabot-runner: exempt` comment: they prove the Ubicloud cache proxy, which a hosted runner cannot show; `test-upload-codescene-coverage.yml` and the push/dispatch-only lanes were already exempt. `test_runner_placement.py` and `test_coverage_watchdog_lane.py` read only the exact combined condition. The 35 mutations cover every armed workflow file plus the contract regex. Heavy-repository note: the repository's own Dependabot PRs (shared-actions pin bumps) are the ones that run here, so the first natural one is the measured run.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the
Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Apply runner conditions .github/workflows/ci.yml, rust-toy-app.yml, test-coverage-watchdog.yml, test-cv005-contracts.yml, test-determine-release-modes.yml, test-export-cargo-metadata.yml, test-install-*.yml, test-rust-build-release-root-discovery.yml, test-setup-rust-*.yml, test-stage-release-artefacts.yml, test-upload-release-assets.yml |
The affected jobs select ubuntu-latest for fork or Dependabot-authored pull requests. Other cases retain ubicloud-standard-2. |
Document and check the policy .github/workflows/test-ubicloud-sccache-proxy.yml, docs/developers-guide.md, tests/workflows/* |
The guide and test patterns describe or check the runner condition. Comments mark the Ubicloud proxy lanes as exempt. |
Possibly related PRs
- leynos/vk#335: Applies the same fork-or-Dependabot runner condition in a separate repository.
- leynos/wireframe#783: Adds the same runner routing rule and its own contract checks.
- leynos/podbot#267: Uses the pull request author to apply the same runner rule in a separate repository.
Suggested reviewers: codescene-access
Priority:
Change: Other
Merge Risk: 
d73bb
-
No actionable merge risk was identified in the Dependabot runner-placement changes.
Pre-merge checks: 
-
Check name Status Explanation Resolution User-Facing Documentation Document the changed runner behaviour in docs/users-guide.md. The PR adds a Dependabot author condition that sends affected pull-request jobs toubuntu-latestinstead ofubicloud-standard-2(for…Add a concise users-guide section that explains the Dependabot author check, the hosted-runner selection, the unchanged Ubicloud behaviour for pushes and other pull requests, the cold-cache consequence, and the explicit Ubicloud cache-proxy… Developer Documentation Document the new Dependabot runner policy in docs/developers-guide.md, including the author check and the hosted fallback. However, the new exception text is inaccurate. Lines 3708–3711 state that b…Correct the developer guide. State separately that the two test-ubicloud-sccache-proxy.ymljobs are markeddependabot-runner: exemptand run on Ubicloud for same-repository Dependabot pull requests. Describe `test-upload-codescene-cover…Observability The pull request changes CI runner placement for Dependabot pull requests. This changes runner resource consumption and cache behaviour, but the diff adds no metric or telemetry update. The affected w… Add bounded CI telemetry for the affected lanes. Record the selected runner pool, job outcome and duration, plus cache outcome where a cache is used. Use fixed labels such as github-hostedandubicloud; do not emit author names, URLs, c…-
Check name Status Explanation Title check The title clearly describes the main change: routing Dependabot pull requests to GitHub-hosted runners. No roadmap or GitHub issue number is required by the provided context. Description check The description directly explains the runner changes, author-based Dependabot detection, exceptions, documentation updates, and validation results. Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Testing (Overall) PASS: The runner-selection change has substantive static contract coverage. tests/workflows/test_runner_placement.py:49-84requires the exact parenthesised `head.repo.fork || pull_request.user.login…Module-Level Documentation Pass the module-level documentation check. The pull request changes workflow YAML, Markdown, and two existing Python test modules. Both changed Python modules already have module docstrings at `tests/… Testing (Unit And Behavioural) Accept the testing coverage. tests/workflows/test_runner_placement.pynow requires the exact fork-or-Dependabot condition and checks the runner arms across every workflow job and matrix value. `test…Testing (Property / Proof) Keep the existing parameterized contract tests. The change updates finite workflow runner declarations and their exact selector regex; it does not introduce an algorithm or invariant over a broad inpu… Testing (Compile-Time / Ui) The pull request changes GitHub Actions YAML, developer documentation, and Python contract tests. It introduces no Rust or TypeScript compile-time behaviour and no text-based or UI-adjacent runtime ou… Unit Architecture Pass the check. The pull request changes only GitHub Actions runner-selection expressions, explanatory documentation, and regular-expression contract tests. It adds no query or command implementation,… Domain Architecture Mark PASS. The pull request changes only GitHub Actions runner expressions, workflow comments, developer documentation, and workflow contract tests. It does not change domain logic, domain models, com… Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files. (19 skipped: 19 unsupported.)
Full details: Testing (Overall)
-
Explanation
PASS: The runner-selection change has substantive static contract coverage.
tests/workflows/test_runner_placement.py:49-84requires the exact parenthesisedhead.repo.fork || pull_request.user.login == 'dependabot[bot]'selector and extracts both runner arms.TestLinuxPlacementRuleat:208-271applies this check to every discovered runner job, including matrix runner values, and rejects missing, inverted, or unrecognised expressions. The watchdog contract independently applies the same exact selector to every watchdog job attests/workflows/test_coverage_watchdog_lane.py:343and:510-543. The test discovery covers all workflow runner jobs through_workflow_reading.runner_job_ids()(:274-288). Therefore plausible regressions such as removing the Dependabot arm, usinggithub.actor, applying the condition to the wrong field, omitting one lane, or reversing the runner arms would fail.
Full details: Module-Level Documentation
-
Explanation
Pass the module-level documentation check. The pull request changes workflow YAML, Markdown, and two existing Python test modules. Both changed Python modules already have module docstrings at
tests/workflows/test_coverage_watchdog_lane.py:1-14andtests/workflows/test_runner_placement.py:1-26. These docstrings explain each module's purpose, utility, and relationship to related workflow checks. The Python changes only update regex conditions; they do not add a module or remove documentation.
Full details: Testing (Unit And Behavioural)
-
Explanation
Accept the testing coverage.
tests/workflows/test_runner_placement.pynow requires the exact fork-or-Dependabot condition and checks the runner arms across every workflow job and matrix value.tests/workflows/test_coverage_watchdog_lane.pyapplies the same contract to every watchdog job and also checks malformed multi-lineruns-onvalues. These tests read the actual workflow YAML at the workflow contract boundary. They do not only exercise mocks or private helpers. The anchored expressions verify the author field, the Dependabot login, the hosted runner arm, and the Ubicloud fallback arm.
Full details: Testing (Property / Proof)
-
Explanation
Keep the existing parameterized contract tests. The change updates finite workflow runner declarations and their exact selector regex; it does not introduce an algorithm or invariant over a broad input, state, ordering, or transition space.
test_runner_placement.pyparametrizes every runner job and checks the exact hosted and Ubicloud arms, whiletest_coverage_watchdog_lane.pyparametrizes every watchdog job and checks the same selector. A property test or exhaustive proof is not warranted.
Full details: Testing (Compile-Time / Ui)
-
Explanation
The pull request changes GitHub Actions YAML, developer documentation, and Python contract tests. It introduces no Rust or TypeScript compile-time behaviour and no text-based or UI-adjacent runtime output. The changed tests assert the exact Dependabot/fork runner expression and its runner arms, which is focused structural coverage; snapshot tests are not appropriate here.
Full details: Unit Architecture
-
Explanation
Pass the check. The pull request changes only GitHub Actions runner-selection expressions, explanatory documentation, and regular-expression contract tests. It adds no query or command implementation, external client, clock, storage access, global state, or new side-effect path. The workflow side effect remains explicit in
runs-on, and the tests keep the runner policy visible through an exact pattern.
Full details: Domain Architecture
-
Explanation
Mark PASS. The pull request changes only GitHub Actions runner expressions, workflow comments, developer documentation, and workflow contract tests. It does not change domain logic, domain models, commands, repositories, or adapters. No domain-boundary violation is introduced.
-
Full details: User-Facing Documentation
-
Explanation
Document the changed runner behaviour in
docs/users-guide.md. The PR adds a Dependabot author condition that sends affected pull-request jobs toubuntu-latestinstead ofubicloud-standard-2(for example,.github/workflows/ci.yml), and it documents the rationale only indocs/developers-guide.mdat lines 3671-3713.docs/users-guide.mdhas no corresponding Dependabot runner-placement section.Resolution
Add a concise users-guide section that explains the Dependabot author check, the hosted-runner selection, the unchanged Ubicloud behaviour for pushes and other pull requests, the cold-cache consequence, and the explicit Ubicloud cache-proxy exceptions. Add the section to the users-guide related-document links if appropriate.
Full details: Developer Documentation
-
Explanation
Document the new Dependabot runner policy in
docs/developers-guide.md, including the author check and the hosted fallback. However, the new exception text is inaccurate. Lines 3708–3711 state that both the Ubicloud sccache jobs andtest-upload-codescene-coverage.ymlstay on Ubicloud for Dependabot and each has adependabot-runner: exemptcomment. Only the two sccache jobs have that comment. The CodeScene workflow instead has a pre-existinggithub.actor != 'dependabot[bot]'guard and does not run for a Dependabot actor, as shown at.github/workflows/test-upload-codescene-coverage.yml:30-33.Resolution
Correct the developer guide. State separately that the two
test-ubicloud-sccache-proxy.ymljobs are markeddependabot-runner: exemptand run on Ubicloud for same-repository Dependabot pull requests. Describetest-upload-codescene-coverage.ymlas a separate pre-existing exemption whose guard skips fork pull requests and Dependabot-actor runs. Remove the claim that each exemption carries the comment.
Full details: Observability
-
Explanation
The pull request changes CI runner placement for Dependabot pull requests. This changes runner resource consumption and cache behaviour, but the diff adds no metric or telemetry update. The affected workflows only change
runs-on/matrix expressions and comments; repository telemetry is used only bycalibrate-ci-telemetry.yml, while the changed workflows do not invokeci-telemetry-startorci-telemetry-finish. The documentation records the cold-cache consequence, but documentation is not an operational metric. GitHub job metadata helps identify the selected runner after a run, but it does not provide the required bounded cache and resource signals for diagnosing degradation.Resolution
Add bounded CI telemetry for the affected lanes. Record the selected runner pool, job outcome and duration, plus cache outcome where a cache is used. Use fixed labels such as
github-hostedandubicloud; do not emit author names, URLs, cache keys or raw errors. Ensure the telemetry runs on failure and cancellation where possible, and document how maintainers use the signals to diagnose cold-cache or runner-resource degradation.
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Forks and bots meet the hosted lane
Runner rules now share a name
Ubicloud keeps its proxy place
Guide and tests record the case
YAML paths align in flight
Comment @coderabbitai help to get the list of available commands.
Reviewer's GuideMechanically rolls out the established fork-runner pattern so Dependabot-authored pull requests use free GitHub-hosted runners on the public repository, with targeted Ubicloud exemptions, documentation, and contract/mutation tests protecting the exact runner-selection behavior. Sequence diagram for Dependabot pull request executionsequenceDiagram
participant Dependabot
participant GitHubActions
participant HostedRunner as ubuntu-latest
participant Ubicloud as ubicloud-standard-2
Dependabot->>GitHubActions: Open pull request
GitHubActions->>GitHubActions: Read pull_request.user.login
alt author is dependabot[bot] or head repository is a fork
GitHubActions->>HostedRunner: Schedule workflow job
else regular same-repository pull request
GitHubActions->>Ubicloud: Schedule workflow job
end
Flow diagram for pull request runner selectionflowchart TD
A[Pull request or workflow event] --> B{Fork pull request?}
B -->|Yes| C[ubuntu-latest]
B -->|No| D{"Author is dependabot[bot]?"}
D -->|Yes| C
D -->|No| E[ubicloud-standard-2]
F[Push, dispatch, or tag event] --> E
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Part of DF12-89
Rollout of the pattern in leynos/typos-config-builder#152 (reviewed and merged): Dependabot pull requests on a public repository run on GitHub-hosted runners, not Ubicloud. User decision of 19 October 2026.
Change
Every Ubicloud
runs-onthat has the fork fallback gains the Dependabot arm, in the pilot's shape:pull_request.user.login(the author), notgithub.actor, which changes on a re-run.mainhave nopull_requestpayload and stay on Ubicloud, so main's caches stay warm.runs-onlines, plus therunner:/os:matrix keys inci.yml,rust-toy-app.ymland thetest-install-*andtest-setup-rust-moldworkflows). The twotest-ubicloud-sccache-proxy.ymljobs carry adependabot-runner: exemptcomment: they prove the Ubicloud cache proxy, which a hosted runner cannot show;test-upload-codescene-coverage.ymland the push/dispatch-only lanes were already exempt.test_runner_placement.pyandtest_coverage_watchdog_lane.pyread only the exact combined condition. The 35 mutations cover every armed workflow file plus the contract regex. Heavy-repository note: the repository's own Dependabot PRs (shared-actions pin bumps) are the ones that run here, so the first natural one is the measured run.docs/developers-guide.mdrecords the reason and the cold-cache consequence.Check script row (before)
["shared-actions", "pending", "44 ubicloud jobs, 34 lacking the arm; 10 without fork fallback"]from~/docs/jm5-dependabot-runners/bin/check.pyonorigin/HEADbefore this change.Gates
pytest tests/workflowsas the Makefile runs it with the act lane off: 1352 passed, 144 skipped;mdtablefix --checkandmarkdownlint-cli2clean.Mutation proof
ci.yml:user.loginreplaced byactor(all jobs)ci.yml: Dependabot arm removed (first job)rust-toy-app.yml:user.loginreplaced byactor(all jobs)rust-toy-app.yml: Dependabot arm removed (first job)test-coverage-watchdog.yml:user.loginreplaced byactor(all jobs)test-coverage-watchdog.yml: Dependabot arm removed (first job)test-cv005-contracts.yml:user.loginreplaced byactor(all jobs)test-cv005-contracts.yml: Dependabot arm removed (first job)test-determine-release-modes.yml:user.loginreplaced byactor(all jobs)test-determine-release-modes.yml: Dependabot arm removed (first job)test-export-cargo-metadata.yml:user.loginreplaced byactor(all jobs)test-export-cargo-metadata.yml: Dependabot arm removed (first job)test-install-makeutil.yml:user.loginreplaced byactor(all jobs)test-install-makeutil.yml: Dependabot arm removed (first job)test-install-mdtablefix.yml:user.loginreplaced byactor(all jobs)test-install-mdtablefix.yml: Dependabot arm removed (first job)test-install-tool.yml:user.loginreplaced byactor(all jobs)test-install-tool.yml: Dependabot arm removed (first job)test-install-whitaker.yml:user.loginreplaced byactor(all jobs)test-install-whitaker.yml: Dependabot arm removed (first job)test-install-yaml-lint.yml:user.loginreplaced byactor(all jobs)test-install-yaml-lint.yml: Dependabot arm removed (first job)test-rust-build-release-root-discovery.yml:user.loginreplaced byactor(all jobs)test-rust-build-release-root-discovery.yml: Dependabot arm removed (first job)test-setup-rust-clang-lld.yml:user.loginreplaced byactor(all jobs)test-setup-rust-clang-lld.yml: Dependabot arm removed (first job)test-setup-rust-mold.yml:user.loginreplaced byactor(all jobs)test-setup-rust-mold.yml: Dependabot arm removed (first job)test-setup-rust-sccache.yml:user.loginreplaced byactor(all jobs)test-setup-rust-sccache.yml: Dependabot arm removed (first job)test-stage-release-artefacts.yml:user.loginreplaced byactor(all jobs)test-stage-release-artefacts.yml: Dependabot arm removed (first job)test-upload-release-assets.yml:user.loginreplaced byactor(all jobs)test-upload-release-assets.yml: Dependabot arm removed (first job)tests/workflows/test_runner_placement.py:r"\s*==\s*'dependabot\[bot\]'\s*\)"->r"\s*==\s*'x'\s*\)"Merge class
Mechanical rollout of the pilot's shape (same expression, same form of contract change, docs paragraph, mutation proof), per the lead's ruling of 19 October.
Overlapping open PRs
These open PRs touch the same kind of files; per the standing rulings they do not hold this PR and are left untouched:
Summary by Sourcery
Extend hosted-runner fallback coverage to Dependabot pull requests across the CI workflows while preserving Ubicloud-specific cache-proxy lanes.
Enhancements:
Tests: