k1nq/TREK
1
0
Fork 0
mirror of https://github.com/mauriceboe/TREK.git synced 2026-10-18 21:16:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: retarget Dependabot pull requests onto dev instead of labelling them (#1926)

Browse Source 
Dependabot cannot be pointed at dev. \	arget-branch\ in dependabot.yml applies to
version updates only, and security updates always open against the default branch.
Security updates are all this repository gets, since there is no dependabot.yml at
all, so every one of them arrives on main.

The branch check then labelled them wrong-base-branch and close-stale-wrong-branch
shut them 24 hours later. Thirteen of the seventeen Dependabot pull requests died
that way; the four that survived were retargeted by hand. The comment the check
leaves asks the author to click Edit, which a bot cannot do.

So retarget them instead. If that fails, because the branch was cut from main and
dev has moved on, it falls through to the existing path so a human sees it rather
than the check quietly passing.

Note this only takes effect once it is on main: pull_request_target loads the
workflow from the pull request's base branch, and these arrive on main.
This commit is contained in:
Maurice
2026-08-13 15:39:35 +02:00
committed by GitHub
parent 9dd0a851ca
commit 1aa1aea57e
1 changed files with 32 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/enforce-target-branch.yml
+32
View File
@@ -68,6 +68,38 @@ jobs:
return;
}
// Dependabot cannot be pointed at dev. `target-branch` in dependabot.yml
// applies to version updates only; security updates always open against
// the default branch, and security updates are all this repository gets
// (there is no dependabot.yml). Labelling them meant close-stale-wrong-branch
// shut them 24 hours later, which is how 13 of them died. Retarget instead:
// a bot cannot click "Edit" the way the comment below asks a human to.
if (context.payload.pull_request.user.login === 'dependabot[bot]') {
try {
await github.rest.pulls.update({
owner: context.repo.owner,
repo: context.repo.repo,
pull_number: prNumber,
base: 'dev',
});
if (labels.includes('wrong-base-branch')) {
await github.rest.issues.removeLabel({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: prNumber,
name: 'wrong-base-branch',
});
}
console.log('Retargeted the Dependabot PR onto dev.');
return;
} catch (err) {
// Retargeting can fail when the branch was cut from main and dev has
// moved on. Fall through to the normal path so a human sees it rather
// than the check passing on a PR that is still aimed at main.
console.log(`Could not retarget the Dependabot PR: ${err.message}`);
}
}
// Base is main — check if this user is a maintainer
let permission = 'none';
try {