ci: replace Snyk upgrade PRs with Dependabot - #504
Merged
Merged
Conversation
Snyk's automatic upgrade PRs can never pass the DCO check. The check is the Probot DCO app, which exempts bots by testing the commit author's GitHub account type: dependabot[bot] is type Bot and is exempt, while snyk-bot is type User and is not. Snyk offers no sign-off option and the DCO app has no allowlist, so the two cannot be reconciled by config. The check has not been blocking anything -- the repo has no branch protection, so 46 of 66 all-time Snyk PRs merged with DCO in ACTION_REQUIRED. That has put unsigned snyk-bot commits on main in quantity and trained everyone to merge past a permanently red check. Moving to Dependabot makes DCO pass on its own and restores the signal. Snyk keeps its security/snyk and license/snyk status checks; only the PR-opening automation moves. Disable automatic fix/upgrade PRs for the website project in app.snyk.io org kagent, or both bots will open PRs for the same bumps. The config covers all three tracked npm projects -- the root Next.js site, /docs-site, and /docs-site/playwright. Every Snyk PR only ever targeted the root, so the other two have had no dependency automation at all. Grouped minor/patch with majors suppressed, following the pattern already in kagent-dev/kagent. Reviewers come from CODEOWNERS. Also adds .github/dco.yml allowing remediation commits, so a maintainer can retroactively sign off on a human contributor's commit instead of asking them to rebase. This does not affect the Snyk case. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Signed-off-by: Rachael Graham <[email protected]>
Rachael-Graham
marked this pull request as draft
September 22, 2026 18:15
Rachael-Graham
marked this pull request as ready for review
September 23, 2026 13:22
kristin-kronstain-brown
approved these changes
Sep 23, 2026
This was referenced Sep 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Snyk's automatic upgrade PRs can never pass our DCO check, and no configuration fixes it.
The check is the Probot DCO app, which exempts bots by testing the commit author's GitHub account type:
dependabot[bot]Botsnyk-botUserSnyk offers no sign-off option and the DCO app has no allowlist key, so the two cannot be reconciled.
The check has not been blocking anything — it has been routinely overridden. This repo has no branch protection and no rulesets, so of 66 all-time Snyk PRs, 46 merged with DCO sitting in
ACTION_REQUIRED(see #478, #474). Unsigned[email protected]commits are onmainin quantity, and a permanently red check has trained everyone to merge past it.Change
Adds
.github/dependabot.yml. Dependabot commits are Bot-type, so DCO passes untouched — confirmed against kagent-dev/kagent#2812–2814, which all show DCOSUCCESS. This restores DCO as a signal that means something.The config covers all three tracked npm projects, not just the root:
/— Next.js marketing site/docs-site— Hugo docs toolchain/docs-site/playwright— screenshot harnessEvery Snyk PR only ever targeted the root, so the other two have had no dependency automation at all. Plus
github-actionsat/. Grouped minor/patch with semver-majors suppressed, following the pattern already established in kagent-dev/kagent. Noreviewers:key — CODEOWNERS already covers this repo.Also adds
.github/dco.ymlenabling remediation commits, so a maintainer can retroactively sign off on a human contributor's commit instead of asking them to rebase. This does not affect the Snyk case; it is a separate quality-of-life fix for drive-by community PRs.Snyk keeps its scanning. The
security/snykandlicense/snykstatus checks are independent of PR-opening and continue to run. Only the PR automation moves.Admin actions still needed
These are not in this PR and need someone with the right access:
kagent— before or alongside merge, or both bots open PRs for the same bumps. (@peterj, whose token opens the current ones.)snyk-*branches were just cleaned up manually (186 → 136 branches); without this setting they re-accumulate.Note on the backlog
Pushing this branch surfaced that GitHub reports 62 vulnerabilities on the default branch (35 high, 22 moderate, 5 low). The grouped minor/patch updates will clear some automatically, but 35 high suggests a backlog worth deliberate attention once these PRs start flowing.
🤖 Generated with Claude Code