chore: simplify auto approve mechanism #17264
Conversation
|
|
| github.event.pull_request.user.login == 'dependabot[bot]' | ||
| || github.event.pull_request.user.login == 'dependabot-preview[bot]' | ||
| || (contains(github.event.pull_request.labels.*.name, 'pr/auto-approve') | ||
| && github.event.pull_request.user.login == 'aws-cdk-automation') |
There was a problem hiding this comment.
Note that this condition was removed because PR's created by aws-cdk-automation already contain the pr/auto-approve label. For example:
|
|
||
| jobs: | ||
| auto-approve: | ||
| if: github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.user.login == 'dependabot-preview[bot]' |
There was a problem hiding this comment.
I believe it should be possible to configure dependabot to add that label on its pull requests so this workflow shouldn't be required
There was a problem hiding this comment.
Its not possible because security related PR's are not coupled with any configuration file, and are controlled by the Dependabot security updates setting in the security analysis page.
Note that dependabot right now is only explicitly configured to upgrade github actions:
aws-cdk/.github/dependabot.yml
Lines 5 to 13 in e26f5be
It does however still create security upgrade PR's: #16421
We decided to keep creating these PR's as a fallback to when our own dependency upgrade PR's is misbehaving. Unfortunately those security related PR's are not configurable, from what I could gather.
|
Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
Complementary of aws/aws-cdk#17264 Related to cdklabs/cdk-ops#1759 --- By submitting this pull request, I confirm that my contribution is made under the terms of the [Apache 2.0 license]. [Apache 2.0 license]: https://www.apache.org/licenses/LICENSE-2.0
Currently, PR's are auto approved if they either: 1. Contain the `pr/auto-approve` label. 2. Created by `dependabot` 3. Created by `aws-cdk-automation` This is somewhat convoluted, and complicates the responsibility of the `auto-approve` workflow. In addition, this makes it impossible to formulate a single GitHub query to lookup all automated PR's that we expect to be approved and merged without human intervention. This PR switches to a simpler mechanism, by which the `auto-approve` workflow will **only** approve PR's that contain the appropriate label, forcing all PR creators to add the label if they wish to be auto-approved. This means we can now use a simple `label:pr/auto-approve` query to find all those automated PR's. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Currently, PR's are auto approved if they either:
pr/auto-approvelabel.dependabotaws-cdk-automationThis is somewhat convoluted, and complicates the responsibility of the
auto-approveworkflow.In addition, this makes it impossible to formulate a single GitHub query to lookup all automated PR's that we expect to be approved and merged without human intervention.
This PR switches to a simpler mechanism, by which the
auto-approveworkflow will only approve PR's that contain the appropriate label, forcing all PR creators to add the label if they wish to be auto-approved.This means we can now use a simple
label:pr/auto-approvequery to find all those automated PR's.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license