From 7fb6debde1689666245151f272fc533310dd84c2 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 16 Sep 2026 20:52:51 +0000 Subject: [PATCH] Clear remaining default-branch CI red Dependency review's only run failed because this repo has no Dependency graph. Skip that gate when the compare API is unavailable so the workflow can go green without pretending findings were reviewed. Dependabot on main still opens breaking majors (Spring Boot 4, k8s 0.25, kubernetes 36) that fail local-regression. Limit groups to minor/patch (Go operator stack to patch) so those PRs stop recurring. Co-authored-by: jmjava --- .github/dependabot.yml | 34 ++++++++++++++ .github/workflows/dependency-review.yml | 47 +++++++++++++++++++ .../tests/test_ci_all_green.py | 29 ++++++++++++ 3 files changed, 110 insertions(+) create mode 100644 .github/workflows/dependency-review.yml create mode 100644 libs/tekton-dag-common/tests/test_ci_all_green.py diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e0221c3..fa16814 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -18,6 +18,13 @@ updates: groups: operator-go: patterns: ["*"] + update-types: + - patch + ignore: + - dependency-name: "k8s.io/*" + update-types: ["version-update:semver-major", "version-update:semver-minor"] + - dependency-name: "sigs.k8s.io/controller-runtime" + update-types: ["version-update:semver-major", "version-update:semver-minor"] - package-ecosystem: npm directory: /management-gui/frontend @@ -26,6 +33,9 @@ updates: groups: management-frontend: patterns: ["*"] + update-types: + - minor + - patch - package-ecosystem: npm directory: /libs/baggage-node @@ -34,6 +44,9 @@ updates: groups: baggage-node: patterns: ["*"] + update-types: + - minor + - patch - package-ecosystem: pip directory: /orchestrator @@ -42,6 +55,9 @@ updates: groups: orchestrator-python: patterns: ["*"] + update-types: + - minor + - patch - package-ecosystem: pip directory: /management-gui/backend @@ -50,6 +66,9 @@ updates: groups: management-backend-python: patterns: ["*"] + update-types: + - minor + - patch - package-ecosystem: pip directory: /libs/tekton-dag-common @@ -58,6 +77,9 @@ updates: groups: common-python: patterns: ["*"] + update-types: + - minor + - patch - package-ecosystem: pip directory: /libs/baggage-python @@ -66,6 +88,9 @@ updates: groups: baggage-python: patterns: ["*"] + update-types: + - minor + - patch - package-ecosystem: maven directory: /libs/baggage-spring-boot-starter @@ -74,6 +99,9 @@ updates: groups: baggage-spring: patterns: ["*"] + update-types: + - minor + - patch - package-ecosystem: maven directory: /libs/baggage-servlet-filter @@ -82,6 +110,9 @@ updates: groups: baggage-servlet: patterns: ["*"] + update-types: + - minor + - patch - package-ecosystem: composer directory: /libs/baggage-php @@ -90,3 +121,6 @@ updates: groups: baggage-php: patterns: ["*"] + update-types: + - minor + - patch diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000..768dd89 --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,47 @@ +name: dependency review + +on: + pull_request: + +permissions: + contents: read + pull-requests: read + +concurrency: + group: dependency-review-${{ github.ref }} + cancel-in-progress: true + +jobs: + dependency-review: + name: Runtime dependency review + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + + - name: Reject new high-risk runtime dependencies + id: review + continue-on-error: true + uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 + with: + fail-on-severity: high + fail-on-scopes: runtime,unknown + license-check: false + show-patched-versions: true + + - name: Skip when Dependency graph is unavailable + if: steps.review.outcome == 'failure' + env: + GH_TOKEN: ${{ github.token }} + run: | + set +e + gh api \ + "repos/${GITHUB_REPOSITORY}/dependency-graph/compare/${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }}" \ + >/tmp/dep-graph.json + code=$? + set -e + if [ "$code" -eq 0 ]; then + echo "Dependency graph is available; dependency-review findings must be fixed." + exit 1 + fi + echo "Dependency graph is not enabled on this repository; skipping review." diff --git a/libs/tekton-dag-common/tests/test_ci_all_green.py b/libs/tekton-dag-common/tests/test_ci_all_green.py new file mode 100644 index 0000000..6db9c39 --- /dev/null +++ b/libs/tekton-dag-common/tests/test_ci_all_green.py @@ -0,0 +1,29 @@ +"""Guards that remaining default-branch CI stays closable to green.""" + +from pathlib import Path + +import yaml + +ROOT = Path(__file__).resolve().parents[3] + + +def test_dependabot_groups_reject_breaking_majors(): + config = yaml.safe_load((ROOT / ".github/dependabot.yml").read_text()) + for entry in config["updates"]: + groups = entry.get("groups") or {} + assert groups, f"{entry['package-ecosystem']} must group updates" + for name, group in groups.items(): + types = set(group.get("update-types") or []) + assert "major" not in types, f"{name} must not auto-open majors" + assert types <= {"minor", "patch"} + if entry["package-ecosystem"] == "gomod": + assert types == {"patch"} + + +def test_dependency_review_skips_when_graph_unavailable(): + workflow = (ROOT / ".github/workflows/dependency-review.yml").read_text() + + assert "actions/dependency-review-action@" in workflow + assert "continue-on-error: true" in workflow + assert "dependency-graph/compare/" in workflow + assert "skipping review" in workflow