ci: dependency review and Renovate config validation by napetrov · Pull Request #302 · intel/dokimi

napetrov · 2026-10-30T05:36:07Z

Summary

Two small CI gates dokimi lacks, taken from the CI survey of oneDAL, scikit-learn-intelex, abicheck and enterprise-agent-toolkit:

dependency-review: pip-audit audits the locks as they are; nothing judges what a PR changes in the dependency graph, and GitHub Actions bumps are not audited at all.
Renovate config validation: a renovate.json5 Renovate cannot parse fails nowhere visible — the bot just stops opening update PRs.

Changes

.github/workflows/dependency-review.yml: actions/dependency-review-action on PRs touching the locks, requirements files, pyproject.toml or workflows; fails on a High/Critical advisory the PR introduces; job summary only (no PR comment, so a fork PR's read-only token is enough).
allow-ghsas carries the 13 filelock advisories SECURITY.md documents (no lock can fix them while litellm requires filelock<4.0), so a PR moving filelock within <4.0 is not failed. Same IDs as pip-audit.yml and osv-scanner.toml; tests/test_advisory_lists.py now checks this fourth list too, and SECURITY.md / the pip-audit comment say "all four".
.github/workflows/renovate-validation.yml: renovate-config-validator --strict on .github/renovate.json5, validator pinned to 44.198.0; a new custom regex manager in renovate.json5 bumps that pin.

Considered and dropped (measured on main): codespell — all hits are deliberate identifiers/test inputs (isntall, udpate, mian, Provence…), as the pre-commit config already notes; ruff-format — would reformat 509 files and conflict with every open PR.

Risk

Both jobs are path-filtered, so they must stay out of the required checks (a required check that never starts holds a PR forever); the workflow comment says so. dependency-review judges GitHub's dependency graph, which lists all eight manifests (requirements*.txt, the three locks, pyproject.toml).

Testing

renovate-config-validator@44.198.0 --strict .github/renovate.json5: validated.
Regex manager matched against the workflow line: ['44.198.0'].
pre-commit (check-yaml, zizmor, ruff) on the changed files: passed.
pytest tests/test_advisory_lists.py: 7 passed; dropping one ID from allow-ghsas makes the new test fail.
Two fresh-context self-review passes, no blocking findings.

Revert

Plain revert; nothing persisted.

Checklist

Tests added/updated and pytest passes
ruff, mypy, and schema checks pass
Docs updated (or N/A) — SECURITY.md
Self-reviewed per "Before opening a PR" in AGENTS.md
No ad-hoc run artifacts committed
New files carry the SPDX license header (or are exempt in .github/.licenserc.yaml)

🤖 Generated with Claude Code

exai-bot · 2026-10-30T05:40:33Z

✅ OpenCodeReview: Review complete: 0 finding(s) across 5 selected item(s).

Review details

Commit reviewed: 9792e16 against merge base 9a46235
Coverage: 5 files in 2 groups
Engine: OpenCodeReview v1.13.3, us.anthropic.claude-sonnet-5-5
Usage: 79k tokens (36k from cache), 11s
Tool calls: 4 (2 code_search, 1 file_find, 1 file_read)
CI workflows and Renovate dependency config: 3 files
Security advisory docs and tests: 2 files

exai-bot · 2026-10-30T05:40:34Z

+
+name: dependency-review
+
+# Fails a PR that adds or moves a dependency to a version with a known


Must-fix: this header is a block of about 13 # lines. check_comment_blocks.py fails any new block over two lines (AGENTS.md), and it also tells backstory instead of the constraint. Reduce it to two lines, for example: path-filtered, so keep it out of the required checks; it judges only the PR's dependency change (pip-audit.yml audits the locks). Put the rest in the PR description.

Fixed in 9792e16: two lines (judges only the PR's dependency change; path-filtered, keep out of required checks). The rest is in the PR description.

exai-bot · 2026-10-30T05:40:34Z

+  dependency-review:
+    name: Dependency review
+    # A short job: ubuntu-latest, as for the other short jobs (see ci.yml).
+    runs-on: ubuntu-latest


Nit: no timeout-minutes, while the other workflows set one (for example agent-quality.yml and conda-forge.yml: 15). A hung job would run for 6 hours. Add timeout-minutes: 10. The same applies to renovate-validation.yml.

Suggestion:

Suggested change

runs-on: ubuntu-latest

runs-on: ubuntu-latest

timeout-minutes: 10

Fixed in 9792e16: timeout-minutes: 10 on both new jobs.

exai-bot · 2026-10-30T05:40:34Z

+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294  # v5.0.0
+        with:
+          fail-on-severity: high
+          # The thirteen filelock advisories SECURITY.md documents, which no


Must-fix: this is a 4-line block, over the two-line limit enforced by check_comment_blocks.py. Shorten it, for example: # filelock advisories from SECURITY.md (litellm needs filelock<4.0); keep in sync with pip-audit.yml and osv-scanner.toml. Without that rewrite, CI fails.

Fixed in 9792e16: two lines, pointing at tests/test_advisory_lists.py, which fails if the four lists drift.

exai-bot · 2026-10-30T05:40:34Z

      # without resolving or installing anything. Each --ignore-vuln is
      # an advisory SECURITY.md documents and dokimi/osv-scanner.toml ignores;
-      # add or drop them together, in all three.
+      # add or drop them together, in all four (dependency-review.yml too).


Must-fix: this edits a 9-line comment block (lines 51-59). scripts/check_comment_blocks.py fails any block over two lines once the PR changes one of its lines, and .yml is in its SUFFIXES. Shorten the block to the reason, for example: # Each --ignore-vuln is documented in SECURITY.md; keep it in sync with osv-scanner.toml and dependency-review.yml., and move the sed/awk detail next to the step.

Fixed in 9792e16 by reverting pip-audit.yml to main: the sync is now enforced by test_dependency_review_allows_the_same_ghsa_ids rather than the comment, so the block is left untouched.

exai-bot · 2026-10-30T05:40:34Z

+
+name: renovate-validation
+
+# Validates .github/renovate.json5 with Renovate's own config validator. A


Must-fix: this header is a 5-line comment block, over the two-line limit that check_comment_blocks.py enforces on new .yml files. Reduce it to two lines, for example: # Renovate silently stops opening PRs on a config it cannot parse; --strict also fails on deprecated options.

Fixed in 9792e16: shortened to your suggested two lines.

dependency-review.yml fails a PR that adds or moves a dependency to a version with a High or Critical advisory, allowing the thirteen filelock advisories SECURITY.md documents (kept in sync by test_advisory_lists.py). renovate-validation.yml runs Renovate's config validator in strict mode, with its version pinned and bumped by a Renovate custom manager. Signed-off-by: Petrov, Nikolay A <nikolay.a.petrov@intel.com>

codecov-commenter · 2026-10-30T06:21:32Z

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.51%. Comparing base (9a46235) to head (9792e16).
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #302   +/-   ##
=======================================
  Coverage   93.50%   93.51%           
=======================================
  Files         273      273           
  Lines       35569    35569           
  Branches     6040     6040           
=======================================
+ Hits        33260    33262    +2     
+ Misses       1492     1491    -1     
+ Partials      817      816    -1

see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

antonwolfy

LGTM. Both workflows are scoped correctly and the new test pins the fourth advisory list. No findings.

What I ran, on a Linux review host at 9792e16:

make ci-local: 29 passed, 0 failed, 7 skipped (job conditions, no docker/semgrep). Changed-line coverage passed.
zizmor on both new workflows: no findings.
check_comment_blocks.py against the base: no block over two lines.
Mutations of allow-ghsas (drop, add, alter or re-case an ID, empty value, key removed): the new test fails on each. Reordering and extra whitespace pass, as they should.

Checked, no issues

Path filter: dokimi/requirements*.txt matches all seven requirements files, locks included; pyproject.toml and the workflow and action directories are listed.
Renovate manager: the matchStrings pattern returns ['44.198.0'] on validator_version: '44.198.0', and the file pattern matches the workflow path.
ID sets: the 13 IDs in allow-ghsas equal the 13 GHSA IDs in osv-scanner.toml.
Docs: the SECURITY.md wording matches fail-on-severity: high and the four lists.

napetrov requested a review from a team as a code owner October 30, 2026 05:36

exai-bot reviewed Oct 30, 2026

View reviewed changes

napetrov force-pushed the ci/dependency-review-renovate-format branch from aa6786b to 9792e16 Compare October 30, 2026 06:06

antonwolfy approved these changes Oct 30, 2026

View reviewed changes

antonwolfy merged commit 83f18fb into main Oct 30, 2026
18 checks passed

antonwolfy deleted the ci/dependency-review-renovate-format branch October 30, 2026 10:21


		name: dependency-review

		# Fails a PR that adds or moves a dependency to a version with a known

	runs-on: ubuntu-latest
	runs-on: ubuntu-latest
	timeout-minutes: 10


		name: renovate-validation

		# Validates .github/renovate.json5 with Renovate's own config validator. A

Conversation

napetrov commented Oct 30, 2026

Summary

Changes

Risk

Testing

Revert

Checklist

Uh oh!

exai-bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov-commenter commented Oct 30, 2026

Codecov Report

Uh oh!

antonwolfy left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

exai-bot commented Oct 30, 2026 •

edited

Loading