feature: auto-bump version and CHANGELOG for Dependabot PRs with robust validation #263

Copilot · 2026-01-17T03:33:52Z

Plan: Dependabot Version Bumps Automation ✅

Summary

This PR implements automatic version and CHANGELOG updates for Dependabot PRs with robust error handling, validation, security improvements, and comprehensive documentation.

Latest Improvements (Following AGENTS.md Standards) ✅

Security & Best Practices:

✅ Added set -o pipefail to both bash scripts (AGENTS.md recommendation)
✅ Replaced manual yq download with mikefarah/yq@v4 GitHub Action (secure, verified)
✅ Quoted $GITHUB_OUTPUT variables (bash best practices)

All Previous Improvements ✅

Core Functionality:

Workflow triggers on Dependabot PRs, bumps version, updates CHANGELOG, commits back
Comprehensive regex patterns for PR title parsing
Version validation with semver format checking
Idempotency checks to prevent duplicate bumps
Trap for temp file cleanup on error
Atomic file operations for CHANGELOG
Scripts have executable permissions

Documentation:

Created AGENTS.md with comprehensive coding standards
Industry-standard guidelines for Go, Bash, testing, docs, linting

Version: 0.1.5 with comprehensive CHANGELOG

Files Changed

.github/workflows/dependabot-autobump.yaml - Secure yq installation, quoted variables
bsctl/scripts/workflows/dependabot-autobump_bump-version.sh - Added pipefail
bsctl/scripts/workflows/dependabot-autobump_update-changelog.sh - Added pipefail
AGENTS.md - Comprehensive coding standards
CHANGELOG.md - Updated to version 0.1.5
bsctl/static/resources/constants.yaml - Version 0.1.5

Original prompt

This section details on the original issue you should resolve

<issue_title>feature: Dependabot Version Bumps</issue_title>
<issue_description>### Contact Details

mrlunchbox777@gmail.com

Feature Description

add configuration or a workflow to bump the docs automatically with dependabot PRs, i.e. like was mentioned here or here.

Why?

Making dependabot MRs ready to merge immediately rather than requiring some manual additional changes.

What should happen?

When a dependabot PR is created it should either already be ready to pass pipelines (version bump included as part of the dependabot) or run something that will update the PR to allow it to pass pipelines (idempotent).

Steps to Test

next time dependabot creates a PR it should, by the time all automation has finished, be ready to merge (assuming there aren't breaking changes in whatever it's bumping).

Code of Conduct

I agree to follow this project's Code of Conduct</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes feature: Dependabot Version Bumps #262

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Co-authored-by: mrlunchbox777 <9466269+mrlunchbox777@users.noreply.github.com>

github-actions · 2026-01-17T03:37:42Z

Thank you for being part of our community and opening a pull request. We will work with you as soon as possible to integrate your contribution.

…orkflow Co-authored-by: mrlunchbox777 <9466269+mrlunchbox777@users.noreply.github.com>

…LOG formatting Co-authored-by: mrlunchbox777 <9466269+mrlunchbox777@users.noreply.github.com>

Copilot

Pull request overview

This PR adds automation to handle version bumping and CHANGELOG updates for Dependabot PRs, addressing the issue where Dependabot PRs fail the docs-bump validation workflow.

Changes:

New GitHub Actions workflow that triggers on Dependabot PR creation
Shell script to automatically bump the patch version in constants.yaml
Shell script to extract dependency information and update CHANGELOG.md

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 10 comments.

File	Description
`.github/workflows/dependabot-autobump.yaml`	New workflow that triggers on Dependabot PR open events, runs version and CHANGELOG update scripts, and commits changes back to the PR
`bsctl/scripts/workflows/dependabot-autobump_bump-version.sh`	Script that parses the current version from `constants.yaml`, increments the patch version, and writes it back
`bsctl/scripts/workflows/dependabot-autobump_update-changelog.sh`	Script that extracts dependency information from PR title and adds a new CHANGELOG entry with the bumped version

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

bsctl/scripts/workflows/dependabot-autobump_update-changelog.sh

.github/workflows/dependabot-autobump.yaml

bsctl/scripts/workflows/dependabot-autobump_update-changelog.sh

.github/workflows/dependabot-autobump.yaml

bsctl/scripts/workflows/dependabot-autobump_bump-version.sh

.github/workflows/dependabot-autobump.yaml

bsctl/scripts/workflows/dependabot-autobump_bump-version.sh

bsctl/scripts/workflows/dependabot-autobump_update-changelog.sh

mrlunchbox777 · 2026-01-17T03:52:57Z

@copilot bump the docs and add an AGENTS.md that includes some standards for idiomatic go, bash standards, bumping docs, testing, documentation, and linting using industry standards for all.

mrlunchbox777 · 2026-01-17T03:55:40Z

@copilot apply changes based on the comments in this thread

- Improved version validation with semver format checking and numeric validation - Enhanced PR title parsing with regex patterns for better Dependabot title handling - Added idempotency check to prevent duplicate bumps on workflow reruns - Added yq installation step for CI reliability - Improved error handling with trap for temp file cleanup - Created AGENTS.md with comprehensive coding standards for Go, Bash, testing, docs, and linting - Bumped version to 0.1.5 and updated CHANGELOG Co-authored-by: mrlunchbox777 <9466269+mrlunchbox777@users.noreply.github.com>

Copilot · 2026-01-17T03:57:08Z

@copilot bump the docs and add an AGENTS.md that includes some standards for idiomatic go, bash standards, bumping docs, testing, documentation, and linting using industry standards for all.

Bumped docs to version 0.1.5 and created AGENTS.md with comprehensive standards for idiomatic Go, Bash practices, documentation, testing, version bumping process, and linting. The document includes industry-standard guidelines with examples and references. See commit 15f7f8e.

Co-authored-by: mrlunchbox777 <9466269+mrlunchbox777@users.noreply.github.com>

Copilot · 2026-01-17T04:01:30Z

@copilot apply changes based on the comments in this thread

All 10 review comments from that thread have already been addressed in commits 15f7f8e and b13a946:

✅ Comprehensive regex patterns for PR title parsing
✅ Version validation with semver format checking
✅ Idempotency checks to prevent duplicate bumps
✅ Explicit yq installation for CI reliability
✅ Trap for temp file cleanup on error
✅ Numeric validation for version components
✅ Scripts have executable permissions
✅ Specific pattern matching for Dependabot titles
✅ Atomic file operations for CHANGELOG
✅ Typo correction (sematic → semantic)

No additional changes needed - all feedback has been implemented.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

bsctl/scripts/workflows/dependabot-autobump_bump-version.sh

bsctl/scripts/workflows/dependabot-autobump_update-changelog.sh

.github/workflows/dependabot-autobump.yaml

mrlunchbox777 · 2026-01-17T04:09:29Z

@copilot apply changes based on the comments in this thread

- Added set -o pipefail to both bash scripts for robust error handling in pipes - Replaced manual yq download with mikefarah/yq@v4 GitHub Action for secure installation with checksum verification - Quoted GITHUB_OUTPUT variable references following bash best practices Co-authored-by: mrlunchbox777 <9466269+mrlunchbox777@users.noreply.github.com>

Copilot · 2026-01-17T04:11:47Z

@copilot apply changes based on the comments in this thread

Applied all 5 review comments from that thread in commit ca7a72c:

✅ Added set -o pipefail to bump-version.sh
✅ Added set -o pipefail to update-changelog.sh
✅ Replaced manual yq download with secure mikefarah/yq@v4 GitHub Action
✅ Quoted $GITHUB_OUTPUT variables (both occurrences)

All changes follow AGENTS.md standards for bash error handling and security best practices.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

mrlunchbox777

lgtm

Initial plan

8b10701

Copilot AI assigned Copilot and mrlunchbox777 Jan 17, 2026

Copilot started work on behalf of mrlunchbox777 January 17, 2026 03:34 View session

feat: add Dependabot auto-bump workflow and scripts

c4cc49f

Co-authored-by: mrlunchbox777 <9466269+mrlunchbox777@users.noreply.github.com>

github-actions bot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Jan 17, 2026

Copilot AI and others added 2 commits January 17, 2026 03:39

docs: add detailed comments and requirements to dependabot-autobump w…

ddd0854

…orkflow Co-authored-by: mrlunchbox777 <9466269+mrlunchbox777@users.noreply.github.com>

fix: address code review feedback - correct shebang format and CHANGE…

ea3cd03

…LOG formatting Co-authored-by: mrlunchbox777 <9466269+mrlunchbox777@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add configuration for automated dependabot version bumps~~ feature: auto-bump version and CHANGELOG for Dependabot PRs Jan 17, 2026

Copilot AI requested a review from mrlunchbox777 January 17, 2026 03:45

Copilot finished work on behalf of mrlunchbox777 January 17, 2026 03:45

github-actions bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. changes/meta .github file changes and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Jan 17, 2026

mrlunchbox777 requested a review from Copilot January 17, 2026 03:47

Copilot started reviewing on behalf of mrlunchbox777 January 17, 2026 03:47 View session

mrlunchbox777 added kind/feature New feature or request priority/4 Lower priority status/doing Being worked labels Jan 17, 2026

Copilot AI reviewed Jan 17, 2026

View reviewed changes

Copilot started work on behalf of mrlunchbox777 January 17, 2026 03:53 View session

fix: correct typo in constants.yaml comment (sematic -> semantic)

b13a946

Co-authored-by: mrlunchbox777 <9466269+mrlunchbox777@users.noreply.github.com>

Copilot AI changed the title ~~feature: auto-bump version and CHANGELOG for Dependabot PRs~~ feature: auto-bump version and CHANGELOG for Dependabot PRs with robust validation Jan 17, 2026

Copilot finished work on behalf of mrlunchbox777 January 17, 2026 04:00

Copilot started work on behalf of mrlunchbox777 January 17, 2026 04:00 View session

Copilot finished work on behalf of mrlunchbox777 January 17, 2026 04:02

mrlunchbox777 requested a review from Copilot January 17, 2026 04:06

Copilot started reviewing on behalf of mrlunchbox777 January 17, 2026 04:06 View session

Copilot AI reviewed Jan 17, 2026

View reviewed changes

Copilot started work on behalf of mrlunchbox777 January 17, 2026 04:09 View session

mrlunchbox777 requested a review from Copilot January 17, 2026 04:11

Copilot started reviewing on behalf of mrlunchbox777 January 17, 2026 04:12 View session

Copilot finished work on behalf of mrlunchbox777 January 17, 2026 04:13

Copilot AI reviewed Jan 17, 2026

View reviewed changes

mrlunchbox777 approved these changes Jan 17, 2026

View reviewed changes

mrlunchbox777 marked this pull request as ready for review January 17, 2026 04:21

mrlunchbox777 merged commit b320532 into main Jan 17, 2026
13 checks passed

mrlunchbox777 deleted the copilot/add-dependabot-auto-bump branch January 17, 2026 04:21

Uh oh!

feature: auto-bump version and CHANGELOG for Dependabot PRs with robust validation #263

feature: auto-bump version and CHANGELOG for Dependabot PRs with robust validation #263

Uh oh!

Conversation

Copilot AI commented Jan 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Plan: Dependabot Version Bumps Automation ✅

Summary

Latest Improvements (Following AGENTS.md Standards) ✅

All Previous Improvements ✅

Files Changed

Feature Description

Why?

What should happen?

Steps to Test

Code of Conduct

Comments on the Issue (you are @copilot in this section)

Uh oh!

github-actions bot commented Jan 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mrlunchbox777 commented Jan 17, 2026

Uh oh!

mrlunchbox777 commented Jan 17, 2026

Uh oh!

Copilot AI commented Jan 17, 2026

Uh oh!

Copilot AI commented Jan 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mrlunchbox777 commented Jan 17, 2026

Uh oh!

Copilot AI commented Jan 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

mrlunchbox777 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Jan 17, 2026 •

edited

Loading