Repository navigation
Run Dependabot pull requests on GitHub-hosted runners - #783
Conversation
Reviewer's GuideThe PR mechanically extends the existing fork fallback so Dependabot-authored pull requests use Sequence diagram for Dependabot runner placementsequenceDiagram
actor Dependabot
participant GitHubActions
participant RunnerSelection
participant Runner
Dependabot->>GitHubActions: Open pull request
GitHubActions->>RunnerSelection: Evaluate runs-on
alt pull_request.user.login == dependabot[bot]
RunnerSelection->>Runner: Select ubuntu-latest
else fork pull request
RunnerSelection->>Runner: Select ubuntu-latest
else push to main or other workload
RunnerSelection->>Runner: Select ubicloud-standard-2
end
Runner-->>GitHubActions: Execute workflow
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
Summary
WalkthroughThe CI workflow now selects ChangesHosted runner selection
Priority: ⬇️ Low Change: Feature Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title accurately summarises the main change: routing Dependabot pull requests to GitHub-hosted runners. The description references DF12-89 but does not identify an existing GitHub issue by number … |
| Description check | |
The description directly explains the runner change, implementation details, tests, documentation updates, and rollout context. It is related to the changeset. |
| Docstring Coverage | |
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files. (2 skipped: 2 … |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
| Testing (Overall) | |
Pass the testing check. The changed behaviour is guarded by substantive workflow-contract tests. test_the_runner_expression_is_exactly_the_reviewed_one reads the parsed ci.yml value and requires t… |
| User-Facing Documentation | |
Pass the user-facing documentation check. The pull request changes GitHub Actions runner placement for fork and Dependabot pull requests, not Wireframe's library API or end-user behaviour. The require… |
| Developer Documentation | |
Pass the developer documentation check. Update docs/developers-guide.md with the Dependabot runner decision, the exact runs-on guard, the author-versus-actor rule, and the hosted-pool cold-cache r… |
| Module-Level Documentation | |
All three changed Python modules carry clear module-level docstrings. ci_runner_placement_test.py explains the assertions and its relationship to the policy and reader modules (lines 1–7). `runner_p… |
| Testing (Unit And Behavioural) | |
Accept the testing coverage. The workflow contract reads the parsed .github/workflows/ci.yml job and checks the single-line expression, the exact combined HOSTED_GUARD, and both runner arms in `te… |
| Testing (Property / Proof) | |
PASS. The change adds one reviewed runner expression and a bounded parser form. The contract compares the parsed guard and both runner arms to exact constants in `tests/workflow_contracts/ci_runner_pl… |
| Testing (Compile-Time / Ui) | |
Pass. The pull request changes GitHub Actions YAML, Markdown, and Python workflow-contract code. It introduces no Rust or TypeScript compile-time behaviour, so trybuild or an equivalent compile-time t… |
| Unit Architecture | |
Keep the change as submitted. The pull request adds declarative workflow policy, documentation, policy constants, and a pure regular-expression parser update. It adds no commands, writes, network call… |
| Domain Architecture | |
Pass. Keep the change as infrastructure-only. The pull request changes .github/workflows/ci.yml runner selection, developer documentation, and workflow-contract tests. It does not change domain mode… |
| Observability | |
PASS — The change alters GitHub Actions runner placement only. It does not alter production request handling, service state, queues, or runtime resource behaviour. The workflow records the selected ru… |
Full details: Title check
-
Explanation
The title accurately summarises the main change: routing Dependabot pull requests to GitHub-hosted runners. The description references DF12-89 but does not identify an existing GitHub issue by number that the title must include.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files. (2 skipped: 2 unsupported.)
Full details: Testing (Overall)
-
Explanation
Pass the testing check. The changed behaviour is guarded by substantive workflow-contract tests.
test_the_runner_expression_is_exactly_the_reviewed_onereads the parsedci.ymlvalue and requires the completeHOSTED_GUARD,ubuntu-latestarm, andubicloud-standard-2arm. This rejects fork-only guards,github.actor, incorrect author fields, a removed Dependabot arm, and incorrect runner labels.runner_placement_reader_test.pyalso exercises the expression reader and rejects unsupported expression forms. The tests therefore check the changed behaviour, not only mock calls or coverage.
Full details: User-Facing Documentation
-
Explanation
Pass the user-facing documentation check. The pull request changes GitHub Actions runner placement for fork and Dependabot pull requests, not Wireframe's library API or end-user behaviour. The required audience is therefore repository developers, and
docs/developers-guide.mddocuments the hosted-runner guard, author check, runner arms, and cold-cache effect at lines 7-45.docs/users-guide.mdremains an API consumer guide for assembling Wireframe applications at lines 1-6, and no user-facing functionality changed.
Full details: Developer Documentation
-
Explanation
Pass the developer documentation check. Update
docs/developers-guide.mdwith the Dependabot runner decision, the exactruns-onguard, the author-versus-actor rule, and the hosted-pool cold-cache rationale (lines 27–45). No new API, tooling requirement, roadmap completion, or execplan is introduced by this pull request, and no additional design document is required for this scoped workflow decision.
Full details: Module-Level Documentation
-
Explanation
All three changed Python modules carry clear module-level docstrings.
ci_runner_placement_test.pyexplains the assertions and its relationship to the policy and reader modules (lines 1–7).runner_placement_policy.pyexplains the reviewed decisions and its enforcement relationship (lines 1–13).runner_placement_reader.pyexplains its parsing utility and its relationship to the policy and test modules (lines 1–11). The pull request adds no module without documentation.
Full details: Testing (Unit And Behavioural)
-
Explanation
Accept the testing coverage. The workflow contract reads the parsed
.github/workflows/ci.ymljob and checks the single-line expression, the exact combinedHOSTED_GUARD, and both runner arms intests/workflow_contracts/ci_runner_placement_test.py(lines 239-285). This rejectsgithub.actorand a missing Dependabot arm. The reader tests cover valid runner forms plus malformed expressions, null values, invalid mappings, sequences, and duplicate declarations intests/workflow_contracts/runner_placement_reader_test.py(lines 47-158). The tests therefore exercise the workflow contract boundary and the changed parser behaviour.make test-workflow-contractsruns the complete workflow-contract suite through the Makefile target (lines 102-104).
Full details: Testing (Property / Proof)
-
Explanation
PASS. The change adds one reviewed runner expression and a bounded parser form. The contract compares the parsed guard and both runner arms to exact constants in
tests/workflow_contracts/ci_runner_placement_test.py, and existing parameterized tests cover accepted and rejectedruns-onforms. The meaningful input set is small and explicit, so a property test would not improve confidence. No lemma or proof assumption is introduced.
Full details: Testing (Compile-Time / Ui)
-
Explanation
Pass. The pull request changes GitHub Actions YAML, Markdown, and Python workflow-contract code. It introduces no Rust or TypeScript compile-time behaviour, so trybuild or an equivalent compile-time test is not required. The runner expression uses focused semantic assertions for its guard and both runner arms, plus parameterized reader tests for expression handling. This is more stable and meaningful than a snapshot of YAML or diagnostic text. No UI or user-facing output changes require snapshot coverage.
Full details: Unit Architecture
-
Explanation
Keep the change as submitted. The pull request adds declarative workflow policy, documentation, policy constants, and a pure regular-expression parser update. It adds no commands, writes, network calls, clocks, global mutable state, or hidden dependencies. The existing workflow reader keeps file parsing at the test boundary, and the changed tests compare parsed values with explicit policy constants. No unit-architecture failure condition is introduced.
Full details: Domain Architecture
-
Explanation
Pass. Keep the change as infrastructure-only. The pull request changes
.github/workflows/ci.ymlrunner selection, developer documentation, and workflow-contract tests. It does not change domain models, commands, repositories, adapters, or production business logic. The newHOSTED_GUARDandRUNNER_EXPRESSIONparse and enforce GitHub Actions runner policy, so they do not introduce transport, persistence, or vendor concerns into domain code.
Full details: Observability
-
Explanation
PASS — The change alters GitHub Actions runner placement only. It does not alter production request handling, service state, queues, or runtime resource behaviour. The workflow records the selected runner and job result, while
.github/workflows/ci.yml:58-64anddocs/developers-guide.mddocument the Dependabot condition and cold-cache effect. No new production logging, metrics, tracing, or alert is required by this change.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
A fork arrives; the runner shifts its place
Dependabot’s author joins the guarded case
Other runs keep their established lane
The contract checks the choice again
Clear rules guide the workflow train
Comment @coderabbitai help to get the list of available commands.
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
The account paying for this security review has reached its Codex usage limits. The payer can check the Codex usage dashboard. For personal accounts, using credits requires enabling “Use credits for security reviews” in Code review settings. If you do not manage the paying account, contact this repository's admins. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
@coderabbitai review |
|
04d6851 to
8361012
Compare
|
Rebased onto main only because the squash merge of a branch whose workflow file diverged from main needs the |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
GitHub-hosted minutes cost nothing on a public repository, so a pull request authored by dependabot[bot] now falls back to ubuntu-latest like a fork's. The expression tests pull_request.user.login rather than github.actor, which changes when someone re-runs or pushes. A push to main has no pull_request payload and stays on Ubicloud, so main still writes the cache. `runner_placement_policy.py` gains `DEPENDABOT_GUARD` and `HOSTED_GUARD`; `runner_placement_reader.py`'s `RUNNER_EXPRESSION` accepts one parenthesised guard; `ci_runner_placement_test.py` requires the guard to equal `HOSTED_GUARD`. Bespoke contract, so this PR takes the full review gate.
8361012 to
61044ff
Compare
Part of DF12-89
Rollout of the pattern in leynos/typos-config-builder#152 (reviewed and merged): Dependabot pull requests on a public repository run on GitHub-hosted runners, not Ubicloud. User decision of 19 October 2026.
Change
Every Ubicloud
runs-onthat has the fork fallback gains the Dependabot arm, in the pilot's shape:pull_request.user.login(the author), notgithub.actor, which changes on a re-run.mainhave nopull_requestpayload and stay on Ubicloud, so main's caches stay warm.runner_placement_policy.pygainsDEPENDABOT_GUARDandHOSTED_GUARD;runner_placement_reader.py'sRUNNER_EXPRESSIONaccepts one parenthesised guard;ci_runner_placement_test.pyrequires the guard to equalHOSTED_GUARD. Bespoke contract, so this PR takes the full review gate.docs/developers-guide.mdrecords the reason and the cold-cache consequence.Check script row (before)
["wireframe", "pending", "2 ubicloud jobs, 1 lacking the arm"]from~/docs/jm5-dependabot-runners/bin/check.pyonorigin/HEADbefore this change.Gates
make test-workflow-contractsequivalent (pytest tests/workflow_contracts, 253 passed),mdtablefix --checkclean.Mutation proof
ci.yml:user.loginreplaced byactor(all jobs)ci.yml: Dependabot arm removed (first job)tests/workflow_contracts/runner_placement_policy.py:s/HOSTED_GUARD: typ.Final = f"\(\{FORK_GUARD\} || \{DEPENDABOT_GUARD\}\)"/HOSTED_GUARD: typ.Final = f"({FORK_GUARD})"/Merge class
Mechanical rollout of the pilot's shape (same expression, same form of contract change, docs paragraph, mutation proof), per the lead's ruling of 19 October.
Overlapping open PRs
These open PRs touch the same kind of files; per the standing rulings they do not hold this PR and are left untouched:
Summary by Sourcery
Run Dependabot pull requests on GitHub-hosted runners while preserving Ubicloud execution for main-branch pushes.
New Features:
Enhancements:
Tests: