ci: exempt dependabot PRs from the semantic title check - #3720
ci: exempt dependabot PRs from the semantic title check#3720Imran Siddique (imran-siddique) wants to merge 1 commit into
Conversation
All 34 open dependabot PRs are red, and for 19 of them the only real failure is Validate PR title, with auto-merge failing behind it. subjectPattern rejects a capitalised subject. Dependabot uses "bump <dep> from a to b" for a version bump and "Update <dep> requirement from x to y" for a requirement range, so about half of what it opens fails a rule its author cannot act on, after running full CI. Keys the exemption on the dependencies label rather than the actor so it covers any bot configured to carry it, and adds labeled/unlabeled to the trigger so a PR labelled after opening is re-evaluated. Signed-off-by: Imran Siddique <imran.siddique@opaque.co>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
|
🔴 Contributor Check: HIGH
Automated check by AGT Contributor Check. |
github-actions
Bot
added
the
needs-review:HIGH
PR Review Summary
Verdict: AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims. |
|
Closing in favour of #3710, which came first and fixes #3559 directly. I opened this without checking whether a fix already existed, which was my mistake: I searched the queue for the failure and not for the remedy. vijay s m (@vijay03-creator) got there a day earlier. Their approach is also the tighter one. Making Recording one thing here so it is not lost, since it is the only respect in which the two differ in behaviour: an actor test does not match a Dependabot PR that a human recreated, because the actor is then the human, while the |
1 participant
The problem
All 34 open dependabot PRs are currently red. For 19 of them the only real failure is
Validate PR title, withauto-mergefailing behind it:#3705 #3703 #3702 #3700 #3699 #3696 #3694 #3693 #3691 #3690 #3689 #3688 #3687 #3682 #3656 #3655 #3623 #3618 #3617The cause
pr-title-check.ymlsetssubjectPattern: ^(?![A-Z]).+$, so the subject may not start with a capital.Dependabot writes its own titles and uses two different verbs:
It says "bump" for a version bump and "Update" for a requirement-range change. Which one it picks depends on the update type, not on anything configurable, and
commit-messageindependabot.ymlcontrols the prefix rather than the verb. So roughly half of what Dependabot opens fails a rule its author cannot act on, after having run full CI.The change
Adds
ignoreLabels: dependenciesto the action.Keyed on the label rather than on
github.actorfor two reasons: it covers any bot configured to carry the label, not just Dependabot, and it lets the action itself exit successfully, so a required-check configuration still sees a passing check rather than a skipped job.labeledandunlabeledjoin the trigger types because the exemption is now label-dependent. Without them, a PR labelled after it opened would keep the verdict from the run that saw no labels.What this does not change
Human PRs are unaffected: the pattern, the type list and the error message are all untouched. The check keeps doing what it is for, which is consistent human titles for the changelog. A bot that already emits a valid conventional prefix on every PR is not what it guards against.
Verification
pr-title-check.ymlparses, and the parsed trigger types andignoreLabelsvalue are as intended.ignoreLabelsis a documented input ofamannn/action-semantic-pull-requestat the pinned v6.1.1.The real test is the next dependabot PR, or a re-run on any of the 19 above.