Repository navigation
Run Dependabot pull requests on GitHub-hosted runners - #553
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. ℹ️ Recent review info
SummaryRoute fork and Dependabot pull requests to Changes
Validation
WalkthroughBuild and coverage jobs now use ChangesRunner selection
Suggested labels: Priority: Change: Feature Merge Risk:
 |
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Title check |  |
The title accurately describes the main change. However, the description references DF12-89, and the title does not include the required issue reference. | Add the referenced issue identifier to the title, for example: "Run Dependabot pull requests on GitHub-hosted runners (DF12-89)" or the required GitHub issue format if available. |
-
Check name Status Explanation Docstring Coverage Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (2 skipped: 2 … Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Testing (Overall) The new runner-selection behaviour has substantive contract coverage. tests/workflow_contracts/runner_placement_test.py:113-123, 172-212discovers every Ubicloud lane reachable from apull_request…User-Facing Documentation Treat this check as not applicable. The pull request changes only CI runner selection and workflow contract tests; it does not change Wildside server behaviour, an API, a CLI, or an end-user interface… Developer Documentation The CI runner change is a tooling and build-placement change, and the pull request documents it in docs/developers-guide.md:236-263. The guide records the hosted-runner condition for fork and Depend…Module-Level Documentation Pass. The pull request changes two Python modules, and both have clear module-level docstrings. runner_labels_test.pydocuments the reader's purpose, behaviour, and use by placement contracts (lines…Testing (Unit And Behavioural) Pass the testing check. The updated workflow contract reads the committed workflow and parametrizes every Ubicloud job reachable from a pull request (tests/workflow_contracts/runner_placement_test.py:… Testing (Property / Proof) The change does not require property-based testing. It adds a small Boolean condition with two predicates: fork status and exact Dependabot author login. The meaningful input space is a short, auditab… Testing (Compile-Time / Ui) PASS — The pull request changes GitHub Actions YAML, Markdown, and Python contract tests only. It introduces no Rust or TypeScript compile-time behaviour, so no trybuild-equivalent test applies. The r… Unit Architecture PASS — The change introduces no query, command, storage, network, clock, or process operation. It updates declarative runs-onexpressions in.github/workflows/ci.yml:60-63, 677-680and keeps the r…Domain Architecture PASS — The pull request changes only GitHub Actions runner selection, workflow-contract tests, and developer documentation. It does not change domain models, commands, repositories, adapters, transpor… Observability Accept the change. It alters CI runner placement, not production service behaviour. GitHub Actions exposes the selected runner, job duration, status, and failure logs. Existing ci.ymldiagnostics al…Description check The pull request description directly matches the changes. It describes routing Dependabot and fork pull requests to GitHub-hosted runners, preserving Ubicloud runners for other events, updating contr… Full details: Docstring Coverage
-
Explanation
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (2 skipped: 2 unsupported.)
Full details: Testing (Overall)
-
Explanation
The new runner-selection behaviour has substantive contract coverage.
tests/workflow_contracts/runner_placement_test.py:113-123, 172-212discovers every Ubicloud lane reachable from apull_request, parses its completeruns-onexpression, and requires the exact(github.event.pull_request.head.repo.fork || github.event.pull_request.user.login == 'dependabot[bot]')condition withubuntu-latestas the hosted arm and an Ubicloud fallback. This rejects the plausible incorrect implementations of usinggithub.actor, omitting the Dependabot arm, swapping the labels, or leaving a lane unchanged.tests/workflow_contracts/runner_labels_test.py:21-30also verifies that the expression reader returns both labels. The tests therefore exercise the changed workflow configuration rather than only checking mocks or test setup.
Full details: User-Facing Documentation
-
Explanation
Treat this check as not applicable. The pull request changes only CI runner selection and workflow contract tests; it does not change Wildside server behaviour, an API, a CLI, or an end-user interface. The internal CI guidance is documented in
docs/developers-guide.md(lines 228-254), while the repository policy reservesdocs/users-guide.mdfor users who apply the project rather than modify its internals (lines 103-118). No user-guide update or migration note is required.
Full details: Developer Documentation
-
Explanation
The CI runner change is a tooling and build-placement change, and the pull request documents it in
docs/developers-guide.md:236-263. The guide records the hosted-runner condition for fork and Dependabot pull requests, the use ofpull_request.user.logininstead ofgithub.actor, the non-pull-request fallback, and the cold-cache consequence. The reviewed diff adds no new ExecPlan or roadmap item, and no parallel locale documentation set is present. The change does not introduce an internal API or system architecture boundary that requires a separate design document or ADR.
Full details: Module-Level Documentation
-
Explanation
Pass. The pull request changes two Python modules, and both have clear module-level docstrings.
runner_labels_test.pydocuments the reader's purpose, behaviour, and use by placement contracts (lines 1-13).runner_placement_test.pydocuments the runner-placement rule, its purpose, and its relationship to workflow triggers andcoverage-main.yml(lines 1-24). The other changed files are YAML and Markdown, not modules.
Full details: Testing (Unit And Behavioural)
-
Explanation
Pass the testing check. The updated workflow contract reads the committed workflow and parametrizes every Ubicloud job reachable from a pull request (tests/workflow_contracts/runner_placement_test.py:113-145). It parses the complete
runs-onexpression and requires the fork condition, thepull_request.user.login == 'dependabot[bot]'arm,ubuntu-latest, and the Ubicloud fallback (lines 176-212). The runner-label tests cover the new expression and retain accepted-form and refusal-path cases (runner_labels_test.py:21-116). These tests exercise the workflow configuration boundary, not only private helpers or mocks.
Full details: Testing (Property / Proof)
-
Explanation
The change does not require property-based testing. It adds a small Boolean condition with two predicates: fork status and exact Dependabot author login. The meaningful input space is a short, auditable truth table, not a large range of states or orderings. The contract tests enumerate every reachable Ubicloud lane in
runner_placement_test.pyand assert the complete expression shape at lines 113-123 and 143-212.runner_labels_test.pyalso uses a focused parameterized case for the new expression at lines 21-30. No introduced lemma or proof assumption requires an exhaustive proof.
Full details: Testing (Compile-Time / Ui)
-
Explanation
PASS — The pull request changes GitHub Actions YAML, Markdown, and Python contract tests only. It introduces no Rust or TypeScript compile-time behaviour, so no trybuild-equivalent test applies. The runner changes are structured configuration, not rendered or UI-adjacent output. Focused assertions in
tests/workflow_contracts/runner_labels_test.py:21-30andtests/workflow_contracts/runner_placement_test.py:193-212verify the labels, condition, and fallback arms directly; snapshots would add brittleness without testing a user-facing output.
Full details: Unit Architecture
-
Explanation
PASS — The change introduces no query, command, storage, network, clock, or process operation. It updates declarative
runs-onexpressions in.github/workflows/ci.yml:60-63, 677-680and keeps the runner policy explicit throughHOSTED_CONDITIONand a focused parser assertion intests/workflow_contracts/runner_placement_test.py:42-63, 193-209. The label test remains a pure input/output contract intests/workflow_contracts/runner_labels_test.py:21-30. No new hidden dependency, mutation, or mixed responsibility is introduced.
Full details: Domain Architecture
-
Explanation
PASS — The pull request changes only GitHub Actions runner selection, workflow-contract tests, and developer documentation. It does not change domain models, commands, repositories, adapters, transport, persistence, or infrastructure-facing domain logic. The runner expressions remain in workflow configuration, so no domain boundary is introduced or weakened.
Full details: Observability
-
Explanation
Accept the change. It alters CI runner placement, not production service behaviour. GitHub Actions exposes the selected runner, job duration, status, and failure logs. Existing
ci.ymldiagnostics also record runner/image-scoped cache keys and cache hits in the step summary (lines 148-165 and 639-664), plus sccache statistics (lines 562-588). The pull request documents the expected cold-cache effect. No new service boundary, sensitive logging, unbounded metric label, or actionable alert requirement is introduced.
Full details: Description check
-
Explanation
The pull request description directly matches the changes. It describes routing Dependabot and fork pull requests to GitHub-hosted runners, preserving Ubicloud runners for other events, updating contract tests, and documenting the policy.
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Forks and Dependabot take the hosted lane
Build and coverage follow the rule
Other events keep their managed runner
Tests check the labels and condition
The guide records how the choice is made
Comment @coderabbitai help to get the list of available commands.
Reviewer's GuideThis PR rolls out the established runner-placement pattern so Dependabot pull requests on the public repository use Sequence diagram for runner selection on pull requestssequenceDiagram
participant GitHub
participant Workflow as ci.yml
participant Runner
GitHub->>Workflow: Trigger pull_request
Workflow->>Workflow: Read pull_request.head.repo.fork
Workflow->>Workflow: Read pull_request.user.login
alt Fork or Dependabot author
Workflow->>Runner: Select ubuntu-latest
else Trusted non-Dependabot workflow
Workflow->>Runner: Select ubicloud-standard-8
end
Flow diagram for Dependabot runner placementflowchart TD
A[Pull request or workflow event] --> B{Fork pull request?}
B -->|Yes| C[ubuntu-latest]
B -->|No| D{"Author is dependabot[bot]?"}
D -->|Yes| C
D -->|No| E[ubicloud-standard-8]
F[Push to main or manual dispatch] --> E
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
The account paying for this security review has reached its Codex usage limits. The payer can check the Codex usage dashboard. For personal accounts, using credits requires enabling “Use credits for security reviews” in Code review settings. If you do not manage the paying account, contact this repository's admins. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
@coderabbitai review |
|
8fde08a to
0d571f2
Compare
|
Rebased onto main only because the squash merge of a branch whose workflow file diverged from main needs the |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
GitHub-hosted minutes cost nothing on a public repository, so a pull request authored by dependabot[bot] now falls back to ubuntu-latest like a fork's. The expression tests pull_request.user.login rather than github.actor, which changes when someone re-runs or pushes. A push to main has no pull_request payload and stays on Ubicloud, so main still writes the cache. `runner_placement_test.py` reads the combined condition and requires it on both `ci.yml` lanes; `runner_labels_test.py` uses the new expression. Wildside is heavy: its `build` job took 70m32s cold on standard-8 and 86m46s on standard-4 against a 90-minute cap, and a Dependabot build is cold on `ubuntu-latest` (4 vCPU). After merge I will measure one real Dependabot run; if it fails for a runner reason (timeout, disk, memory) the follow-up PR keeps that job on Ubicloud with a comment giving the run URL, per the packet. Bespoke contract, so this PR takes the full review gate.
0d571f2 to
eed9d3d
Compare
Part of DF12-89
Rollout of the pattern in leynos/typos-config-builder#152 (reviewed and merged): Dependabot pull requests on a public repository run on GitHub-hosted runners, not Ubicloud. User decision of 19 October 2026.
Change
Every Ubicloud
runs-onthat has the fork fallback gains the Dependabot arm, in the pilot's shape:pull_request.user.login(the author), notgithub.actor, which changes on a re-run.mainhave nopull_requestpayload and stay on Ubicloud, so main's caches stay warm.runner_placement_test.pyreads the combined condition and requires it on bothci.ymllanes;runner_labels_test.pyuses the new expression. Wildside is heavy: itsbuildjob took 70m32s cold on standard-8 and 86m46s on standard-4 against a 90-minute cap, and a Dependabot build is cold onubuntu-latest(4 vCPU). After merge I will measure one real Dependabot run; if it fails for a runner reason (timeout, disk, memory) the follow-up PR keeps that job on Ubicloud with a comment giving the run URL, per the packet. Bespoke contract, so this PR takes the full review gate.docs/developers-guide.mdrecords the reason and the cold-cache consequence.Check script row (before)
["wildside", "pending", "3 ubicloud jobs, 1 lacking the arm"]from~/docs/jm5-dependabot-runners/bin/check.pyonorigin/HEADbefore this change.Gates
pytest --doctest-modules tests/workflow_contracts: 584 passed; the 22 failures are the typedoc documentation-gate tests (documentation_gate*_test.py), which need the workspace's installed Node tooling and fail identically without this change. The runner contracts pass.mdtablefix --checkclean.Mutation proof
ci.yml:user.loginreplaced byactor(all jobs)ci.yml: Dependabot arm removed (first job)tests/workflow_contracts/runner_placement_test.py: `HOSTED_CONDITION: typ.Final[str] = f"({FORK_FIELD}Merge class
Mechanical rollout of the pilot's shape (same expression, same form of contract change, docs paragraph, mutation proof), per the lead's ruling of 19 October.
Overlapping open PRs
These open PRs touch the same kind of files; per the standing rulings they do not hold this PR and are left untouched:
Summary by Sourcery
Route Dependabot pull requests to GitHub-hosted runners while preserving Ubicloud execution for trusted events.
New Features:
Enhancements:
Documentation:
Tests:
Selector proof
Selector proof: natural Dependabot runs on ubuntu-latest, all green: https://github.com/leynos/actix-v2a/actions/runs/39958329992, https://github.com/leynos/typos-config-builder/actions/runs/39990740324, https://github.com/leynos/agentland/actions/runs/39965006591; and a main push staying on ubicloud-standard-2: https://github.com/leynos/typos-config-builder/actions/runs/39181228629.