ci(NOJIRA-1234): Extend bot automerge to smartling and aikido - #761
ci(NOJIRA-1234): Extend bot automerge to smartling and aikido#761Jlougedo-TF wants to merge 4 commits into
Conversation
Gate on the PR author login instead of a single actor, so translation PRs from smartling-github-connector[bot] and security fixes from aikido-autofix[bot] are auto-approved and auto-merged alongside dependabot. Titles are not a reliable signal for these bots, so the allowlist keys off github.actor only. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
| Status | Category | File | Details |
|---|---|---|---|
| Accepted Risk | business_logic | .github/workflows/dependabot-automerge.yml |
Developer removed smartling-github-connector[bot] from the allowlist with an explicit comment ('Smartling is omitted: no translated content in this repo'), narrowing the scope of the original finding. The aikido-autofix[bot] portion of the concern remains and is re-reported. |
@pr-auditor rescan to re-run · Powered by Claude Sonnet 5 · Docs · #security-engineering-team
This repo has no Smartling-managed content: the smartling-github-connector[bot] has never opened a PR here and there is no Smartling config. Narrow the allowlist to the bots that actually raise PRs in this repo. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A green CI run does not prove a transitive dependency bump is safe: the repo's own tests never exercise how the intermediate package uses the changed API. Approve as before, but only arm auto-merge when the diff looks routine. Held back for a human when any of these match: - the bot's title declares a major version upgrade - a JS manifest touches resolutions/overrides (a forced transitive pin) - go.mod gains a +incompatible major bump - more than 6 manifest dependency lines change at once - the lockfile rewrite exceeds 600 lines Validated against 13 real bot PRs: correctly holds xfiles#543 (docker v24->v25 +incompatible), blocks#3039 (major axios), renderer#1481 and mail-composer#400 (forced resolutions), and correctly passes the single direct minor bumps such as embed#760, pages#620 and purgatory#314. Also drops the checkout and 'apt-get install gh' steps: nothing read the working tree (gh is API-only) and gh ships on ubuntu-latest. All repos now hold a byte-identical file apart from the allowlist line. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Assess risk first, then approve only when the diff looks routine. A risky PR now gets no approval at all, so it cannot satisfy the required-review count and a human has to sign it off - the label alone was advisory, since a bot approval already met the review requirement. Also close the stale-arming gap: a PR can open looking routine (approved, auto-merge armed) and then be force-pushed into something risky. On the risky path the workflow now calls 'gh pr merge --disable-auto' and dismisses its own earlier approval before labelling and commenting. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1 participant
Gate on the PR author login instead of a single actor, so translation PRs from smartling-github-connector[bot] and security fixes from aikido-autofix[bot] are auto-approved and auto-merged alongside dependabot.
Titles are not a reliable signal for these bots, so the allowlist keys off github.actor only.
Overview
Jira ticket: https://typeform.atlassian.net/browse/<TICKET_ID>
Changes
Testing
Docs
For contributions to the
Typeform/.githubrepoNote: Please do not use this repository for new internal shared workflows and actions. Use https://github.com/Typeform/.github-private instead!
Please check that your contribution applies to one of these cases below. If this is not the case, please contribute to https://github.com/Typeform/.github-private instead.