ci(security): run the weekly Dependabot fix routine in GitHub Actions - #1790
Open
PMerlet wants to merge 6 commits into
Open
ci(security): run the weekly Dependabot fix routine in GitHub Actions#1790PMerlet wants to merge 6 commits into
PMerlet wants to merge 6 commits into
Conversation
The claude.ai cloud routines cannot call the Dependabot alerts API (the cloud GitHub proxy substitutes its own app token on api.github.com by design). Same schedule (Thursdays 11:00 UTC), same agent instructions, now running where the SECURITY_GH_PAT secret reaches the job untouched. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
|
Coverage Impact This PR will not change total coverage. 🚦 See full report on Qlty Cloud »🛟 Help
|
…kflow - raise the job timeout to 240 min to cover the full CI-polling retry budget - resume the existing security/<date> branch and PR on same-day reruns - refresh the head SHA after each corrective push during CI monitoring - treat an empty combined-status (total_count: 0) as no status gate - provide GH_PAT at job level instead of step level Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- override the action's default guardrails (--append-system-prompt) so the unattended agent actually pushes the security branch and opens the PR - same-day rerun now supersedes the dated branch with --force-with-lease (recomputed from scratch), instead of fragile stash/resume logic that could carry stale history from closed PRs - phase 8: startup guard against vacuous green (zero workflow runs), all-green now also requires combined status success when contexts exist, failing status contexts are reported explicitly - agent-ruby: Gemfile.lock is gitignored (library repo) — preflight and fix strategy reworked around gemspec/Gemfile constraints, local-only lock Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- pin anthropics/claude-code-action to an immutable commit SHA (supply chain: the job holds ANTHROPIC_API_KEY and a repo-write PAT) - fetch the remote security branch before --force-with-lease so the lease has an expected value (fresh checkouts only fetch the default branch) - set SHA via git rev-parse HEAD on every path, including PR reuse - agent-ruby: treat all packages/*/*.gemspec as direct-dependency owners (monorepo of published gems); Gemfile pins flagged as CI-only fixes; generate the local Gemfile.lock in the workflow before the agent runs Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- treat skipped/neutral workflow conclusions as non-failures; only failure/timed_out/cancelled/action_required trigger remediation - the 'unreachable code path' IGNORE reason now requires call-chain or configuration evidence — a negative repo grep alone is insufficient Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- the _example/ ignore rule now requires a workspace-aware resolved-tree check (npm ls --all / yarn why); manifest grep is not sufficient - direct bumps and resolutions/overrides pins now target the smallest patched version within the parent-compatible major instead of an unbounded >= range that could resolve to a breaking major Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The weekly "Fix vulnerabilities" claude.ai cloud routines have been failing with
403on the Dependabot alerts API. Root cause (established 2026-07-23): the Claude cloud environments' GitHub proxy replaces theAuthorizationheader of every request toapi.github.comwith its own GitHub App user-to-server token — regardless of any PAT configured in the environment — and that token cannot read Dependabot alerts, Actions runs, or commit statuses. This is by design ("keeps your real GitHub credentials outside the sandbox"), so the routine can never work there.This PR moves the same routine into GitHub Actions, where secrets reach the job untouched.
What
.github/workflows/security-fixes.yml— scheduled job (Thursdays 11:00 UTC, same slot as before), runs the agent viaanthropics/claude-code-action@v1, 120 min timeout, manual trigger available (workflow_dispatch)..github/security-fixes-prompt.md— the agent instructions (same battle-tested prompt as the cloud routine: preflight probe, strict triage with explicit ignore reasons, 7-day age gate, narrowest-bump-first strategy, pin/resolution hygiene audit, PR with the:lock: securitylabel pinging@first_level_support, CI monitoring with a 3-retry cap).Before merging — org secrets required
The workflow needs two organization-level secrets (shared by the 5 repos getting this workflow:
forestadmin-server,forestadmin,toolbelt,agent-nodejs,agent-ruby):SECURITY_GH_PATANTHROPIC_API_KEYWithout them, the run stops at preflight with an explicit error message.
Notes
🤖 Generated with Claude Code
Note
Add weekly GitHub Actions workflow to automate Dependabot vulnerability fixes via Claude
anthropics/claude-code-actionto triage and fix Dependabot alerts, then open labeled PRs.SECURITY_GH_PAT) for checkout and push operations, with a 240-minute timeout and concurrency guard (cancel-in-progress: false).Macroscope summarized 3162e24.