Extend Dependabot workflow to auto-fix build, lint, and test failures#324
Extend Dependabot workflow to auto-fix build, lint, and test failures#324umair-ably merged 1 commit intomainfrom
Conversation
- Add test step (pnpm test:unit) so Claude can diagnose and fix test failures from dependency bumps (e.g. React 18→19 in PR #308) - Move git config before any commit steps so Claude's commits work even when lockfile is unchanged - Fix pipefail in build/lint steps so exit codes propagate through tee - Fix output capture: use GITHUB_OUTPUT with heredoc delimiters instead of shell substitution (which doesn't work in with: values) - Truncate logs to last 200 lines to avoid GITHUB_OUTPUT size limits - Use accurate fallback messages instead of misleading "succeeded" text
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
WalkthroughThis PR extends the Dependabot lockfile workflow to also run build, lint, and unit tests after regenerating the lockfile, so Claude can diagnose and fix failures introduced by dependency bumps (e.g. the React 18→19 breakage in #308). It also replaces the job-level Changes
Review Notes
|
![claude-code-ably-assistant[bot]](https://avatars.githubusercontent.com/in/2109912?s=60&v=4){kind=small}
There was a problem hiding this comment.
PR Review
Overview: Moves the Dependabot guard from a job-level if condition to a step-based check against the PR author (not triggering actor), so the workflow re-runs after the bot pushes fix commits. Adds loop-prevention (max 2 successes) and extends tests to include the React web CLI package.
Bug to fix: gh run list without --limit
gh run list defaults to 20 most recent runs. If there are >20 runs on the branch, the success count is underestimated and the loop cap fails to enforce. Add --limit 30 to the command.
Verify the app/dependabot author format
gh pr view with --json author queries GraphQL, where bots use app/ format (vs name[bot] in REST). So app/dependabot is likely correct - but confirm against a real Dependabot PR before merging. If wrong, the guard always skips and the workflow never runs for Dependabot PRs.
Everything else is correct:
- Security: guard step uses only github.token (no secrets). Checkout of PR head is still gated behind the skip guard - non-Dependabot PRs never reach it.
- Capture error output and Fix issues with Claude are implicitly safe: they depend on needs-fix output, which itself has the skip guard.
- Test exit code aggregation (failed=0 / || failed=1 / exit failed) correctly handles multiple test commands.
- Lint/test gating on build success is correct.
2 participants
Summary
if) so the PR status shows green instead of "skipped"Test plan
@dependabot recreateon fix(deps): bump the all-dependencies group across 1 directory with 9 updates #308