Repository navigation
feat(init): provision the labels a repo's dependabot.yml declares - #3116
Conversation
Dependabot never creates a custom label and drops a missing one from its PRs, so the 'dependencies' label the spec-gate skip keys on never existed until someone created it by hand. dotf init github now reads the target repo's own dependabot.yml and creates each declared label it lacks, beside delete_branch_on_merge; a create the server rejects fails the command. bitacora-rollout.sh applies both defaults per repo through dotf init github (--dry-run under --check), and treats a [WARN] skip as an error: nobody reads a notice in a rollout. Refs #1222
…o skip Both were unguarded: a mutation dropping either survived the suite. The missing-file check now matches 'HTTP 404' rather than a bare '404'. Refs #1222
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 23 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. CodeRabbit Verify
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| - [x] Lint passes | ||
| - [x] No unrelated changes in the diff (no scope creep) | ||
| - [x] `verification.md` filled in | ||
| - [ ] PR opened referencing this spec folder |
There was a problem hiding this comment.
Harness compliance
Class: REAL
Definition of Done (closing pass / board): the PR is submitted while its own closing boxes are still unticked. tasks.md still reads "- [ ] PR opened referencing this spec folder" even though this PR opens it and references the spec folder, and verification.md's archive checklist still has the bitácora board item unchecked while the PR presents the change as complete. A reader of the spec folder cannot tell whether the board/ticket step was performed, deferred to merge, or simply forgotten; DoD requires silence to be a stated skip, not an unticked box.
| if err != nil { | ||
| var exit *exec.ExitError | ||
| if errors.As(err, &exit) && strings.Contains(string(exit.Stderr), "HTTP 404") { | ||
| continue | ||
| } |
There was a problem hiding this comment.
Silent success
Class: REAL
A 404 from the contents API is treated as "this repo declares no labels", turning an unreadable dependabot.yml into an [OK] result instead of the loud failure #1222 asks for. Trace: a private repository (or one a fine-grained token has not been granted) answers HTTP 404 for gh api /repos/<r>/contents/.github/dependabot.yml even though the file exists; dependabotLabels hits the continue branch, finds no .yaml either, returns (nil, nil), and ApplyDependabotLabels reports Action none — and it does so before gh label list is ever called, so the proposal's stated mitigation ("an unauthorized repo then fails label list → skip") is unreachable on this path. The rollout then prints [OK] ... current and the label stays unprovisioned: exactly the silent divergence the issue exists to close. Uncertainty: for a public repo a permission failure more often surfaces as 403, which the code already skips loudly; the silent path is the 404-masked case.
| labels, err := ApplyDependabotLabels(repo, dryRun) | ||
| if err != nil { | ||
| return "warn", detail + "; " + err.Error() | ||
| } | ||
| return "ok", detail + "; " + labels.Summary() |
There was a problem hiding this comment.
Status mislabeled
Class: THEORETICAL
In the github step of dotf init, a skipped label provision is folded into status ok, unlike the delete-branch default directly above it, which returns skipped. Trace: gh is present and the repo-settings read succeeds so delete-branch completes, but the dependabot.yml read fails with a non-404 (502, offline) → ApplyDependabotLabels returns Action skipped → initGithubWithDryRun returns ("ok", "...; dependabot labels skipped: ..."). Any consumer that keys on the status (the init summary / okOrSkip accounting) records a success for a degraded step, and only the free-text detail reveals the skip. The rollout path is unaffected because it calls dotf init github and fails on any [WARN].
PR Reviewer Guide 🔍Here are some key observations to aid the review process:
⚙️ Agent run details
|
The delete-branch default above it already reports its skip; folding the labels skip into ok left only the free-text detail to show it. Refs #1222
Review triageReviewed by pr-agent (github-actions) on
Ticketed: #3121 ( |
Closes #1222
Spec:
specs/HARNESS-081-dependabot-labels-provisioned/Summary
Dependabot applies a custom label only if it already exists, and it never creates one. The
dependencieslabel that the spec-gate skip keys on only existed after someone created it by hand.dotf init github(and thegithubstep ofdotf init) reads the target repo's own.github/dependabot.yml(or.yaml) and creates each declared label the repo lacks, alongsidedelete_branch_on_merge.--dry-runlists the labels it would create.scripts/bitacora-rollout.shadds a step 3b that runsdotf init github --repo <owner>/<repo>.--checkit passes--dry-run. It does not run under--backfill-only.[WARN]skip counts as an error.Verification
cd cli && go build ./... && go vet ./... && GOOS=windows go vet ./... && go test ./...passes.golangci-lint run(2.12.2, the pinned version) reports 0 issues.shellcheck scripts/bitacora-rollout.shis clean.bats tests/bitacora-rollout.bats tests/stub-real-pairing.batspasses 22/22 under/bin/bash3.2.BITACORA_PAT,--checkfirst.Knowledge