ci: skip irrelevant jobs on Dependabot bumps; un-block EOL Laravel 11#185
ci: skip irrelevant jobs on Dependabot bumps; un-block EOL Laravel 11#185Vusys wants to merge 2 commits into
Conversation
github-actions Dependabot PRs (action SHA bumps) change zero PHP, yet ran the full 36-cell PHP matrix, Bencher, and PR mutation testing — all irrelevant and the matrix/Bencher were failing for reasons unrelated to the bump: - The Laravel 11.0 cells die at `composer update`: 11.x is EOL and now carries five security advisories, but the ignore-list only covered one, so the resolver blocked install. This reddened every PR and master, not just Dependabot. Extend the ignore-list with the four new IDs. - Bencher PRs run against the Dependabot secret store, so BENCHER_API_KEY is empty and the comparison step always exits 2. Changes: - tests.yml: PHP matrix skips `dependabot/github_actions/*`; add a small actionlint job so action bumps still get a meaningful check; extend the EOL Laravel 11 advisory ignore-list. - bencher.yml: skip Bencher on all Dependabot PRs (master baseline still runs with real secrets). - infection.yml: PR diff-mutation skips github-actions bumps.
|
Looking for one thing? Review this PR in Change Stack to search files, summaries, diffs, and code without losing your place. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThree GitHub Actions workflows are updated to avoid running unnecessary jobs on Dependabot PRs; Laravel 11 advisory ignores are expanded, an actionlint job is added, and the Infection ChangesWorkflow CI Optimizations and Linting
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Bencher Report| Branch | ci/skip-irrelevant-jobs-on-dependabot-bumps |
| Testbed | ubuntu-latest |
⚠️ WARNING: Truncated view!The full continuous benchmarking report exceeds the maximum length allowed on this platform.
🐰 View full continuous benchmarking report in Bencher
⚠️ WARNING: No Threshold found!Without a Threshold, no Alerts will ever be generated.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/tests.yml (1)
30-32:⚠️ Potential issue | 🟠 Major | ⚡ Quick winAlign the test matrix with the documented 24-cell CI contract.
php: ['8.3', '8.4', '8.5']expands this workflow to 36 matrix cells, but the workflow guideline defines a 24-cell matrix (PHP 8.3/8.4 × Laravel 11/12/13 × sqlite/mysql/mariadb/pgsql).Suggested change
- php: ['8.3', '8.4', '8.5'] + php: ['8.3', '8.4']As per coding guidelines: "Tests run a 24-cell matrix (PHP 8.3/8.4 × Laravel 11/12/13 × sqlite/mysql/mariadb/pgsql)."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/tests.yml around lines 30 - 32, The CI matrix currently lists php: ['8.3', '8.4', '8.5'] which expands to 36 cells; update the workflow matrix (the php, laravel and db entries in the tests.yml job) to match the documented 24-cell contract by removing PHP 8.5 so php becomes ['8.3','8.4'] while keeping laravel: ['11.0','12.0','13.0'] and db: [sqlite, mysql, mariadb, pgsql]; ensure no other matrix permutations are added so the total stays 24 cells.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/tests.yml:
- Around line 30-32: The CI matrix currently lists php: ['8.3', '8.4', '8.5']
which expands to 36 cells; update the workflow matrix (the php, laravel and db
entries in the tests.yml job) to match the documented 24-cell contract by
removing PHP 8.5 so php becomes ['8.3','8.4'] while keeping laravel:
['11.0','12.0','13.0'] and db: [sqlite, mysql, mariadb, pgsql]; ensure no other
matrix permutations are added so the total stays 24 cells.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 46bbcc9f-9cd5-437e-8b23-6adb19fad852
📒 Files selected for processing (3)
.github/workflows/bencher.yml.github/workflows/infection.yml.github/workflows/tests.yml
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #185 +/- ##
=========================================
Coverage 93.82% 93.82%
Complexity 3779 3779
=========================================
Files 134 134
Lines 11847 11847
=========================================
Hits 11116 11116
Misses 731 731
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
2 participants
Why
The three open github-actions Dependabot PRs (#172, #173, #174) are all red, for two reasons — neither caused by the bump itself:
composer update(not in a test). Laravel 11.x is EOL and now carries five security advisories; the workflow's ignore-list only covered one (PKSA-mdq4-51ck-6kdq), so Composer's resolver blocked install. This reddens every PR and master right now, not just Dependabot.BENCHER_API_KEYis empty and the comparison step exits 2. Guaranteed red on every Dependabot PR regardless of what it bumps.A github-actions bump (an action SHA) changes zero PHP, so running the full 36-cell matrix + Bencher + PR mutation testing is wasteful as well as misleading.
What
tests.ymldependabot/github_actions/*branches. Composer bumps (thecomposer-dev-toolsgroup) still run the full matrix.actionlintjob (runs on every PR) so action bumps get a meaningful green check rather than just skipping everything.bencher.yml— skip Bencher on all Dependabot PRs; the master-push baseline still runs with real secrets.infection.yml— PR diff-mutation job skips github-actions bumps.Performance needs no change — it's gated on the
run-perflabel and never fired on these PRs.Notes
composer config policy.advisories.ignore-id A B Cproduces the expected JSON array.Summary by CodeRabbit