Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: simplify auto approve mechanism #17264

Merged
merged 3 commits into from
Nov 1, 2021
Merged

chore: simplify auto approve mechanism #17264

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3ef5900
add auto approve label to dependabot prs
iliapolo Nov 1, 2021
c5ecc0d
remove dependabot from rule and use standard auto approve label
iliapolo Nov 1, 2021
415e4a1
Merge branch 'master' into epolon/add-auto-approve-label-to-dependabot
mergify[bot] Nov 1, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 1 addition & 5 deletions .github/workflows/auto-approve.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,7 @@ on:

jobs:
auto-approve:
if: >
github.event.pull_request.user.login == 'dependabot[bot]'
|| github.event.pull_request.user.login == 'dependabot-preview[bot]'
|| (contains(github.event.pull_request.labels.*.name, 'pr/auto-approve')
&& github.event.pull_request.user.login == 'aws-cdk-automation')
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that this condition was removed because PR's created by aws-cdk-automation already contain the pr/auto-approve label. For example:

#17223

if: contains(github.event.pull_request.labels.*.name, 'pr/auto-approve')
runs-on: ubuntu-latest
permissions:
pull-requests: write
Expand Down
17 changes: 17 additions & 0 deletions .github/workflows/pr-labeler.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
# Apply various labels on PRs

name: pr-labeler
on:
pull_request:
types: [ opened ]

jobs:
auto-approve:
if: github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.user.login == 'dependabot-preview[bot]'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe it should be possible to configure dependabot to add that label on its pull requests so this workflow shouldn't be required

Copy link
Contributor Author

@iliapolo iliapolo Nov 1, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Its not possible because security related PR's are not coupled with any configuration file, and are controlled by the Dependabot security updates setting in the security analysis page.

Note that dependabot right now is only explicitly configured to upgrade github actions:

aws-cdk/.github/dependabot.yml

Lines 5 to 13 in e26f5be

version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
labels:
- "pr/auto-approve"
open-pull-requests-limit: 5

It does however still create security upgrade PR's: #16421

We decided to keep creating these PR's as a fallback to when our own dependency upgrade PR's is misbehaving. Unfortunately those security related PR's are not configurable, from what I could gather.

runs-on: ubuntu-latest
permissions:
pull-requests: write
steps:
- run: gh pr edit ${{ github.event.pull_request.number }} --add-label "pr/auto-approve" -R ${{ github.repository }}
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}