Repository navigation
Conversation
…cense list Configure Dependabot version updates for GitHub Actions and Go modules on a monthly schedule with a 7 day cooldown. Updates are grouped (one group for all actions; kubernetes/helm, cert-manager, testing, golang-x and a catch-all for Go) so that a month of bumps arrives as a handful of PRs. Security updates for Go are grouped as well. zookeeper-operator is ignored since its version is pinned across Makefile, Helm chart and docs. Add a workflow that regenerates dependency_licenses.csv on Dependabot PRs, commits it to the PR branch and re-dispatches the regular PR checks, so the PRs become mergeable without manual intervention. check.yaml and smoke-tests.yaml gain a workflow_dispatch trigger for that purpose.
Contributor
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
4 open issues
cooldownis not a Dependabot config key in the options reference up to 2025; if unsupported in… · Newcooldownis not a Dependabot config key in the options reference up to 2025; if unsupported in… · New
What changed in this PR
Adds Dependabot automation and supporting workflows so dependency update PRs are fewer, grouped, and become mergeable without manual regeneration of dependency_licenses.csv.
Changes:
- Add
.github/dependabot.ymlto group monthly GitHub Actions + Go module updates (including security updates) and ignore a pinned dependency. - Add a
dependabot-licensesworkflow to regeneratedependency_licenses.csv, commit it back to Dependabot PR branches, and re-trigger CI. - Enable
workflow_dispatchfor existingcheckandsmoke-testsworkflows so they can be re-run after the fix-up push.
| File | Description |
|---|---|
.github/workflows/smoke-tests.yaml |
Allows manual dispatch so CI can be re-triggered after the license list fix-up commit. |
.github/workflows/dependabot-licenses.yaml |
New automation to regenerate and commit dependency_licenses.csv for Dependabot PRs and re-run checks. |
.github/workflows/check.yaml |
Allows manual dispatch so CI can be re-triggered after the license list fix-up commit. |
.github/dependabot.yml |
New Dependabot config for monthly grouped updates across GitHub Actions and Go modules. |
Review effort: Lite
Copilot stopped reviewing on behalf of
janhoy due to an error
October 23, 2026 11:29
…ment cooldown - Check out the PR head SHA instead of the branch ref so the fix-up commit is always based on the commit the event was about. A non-forced push to the branch is rejected if the branch moved meanwhile, and the concurrency group cancels the stale run so a fresh run takes over. - Document that cooldown only applies to version updates and link to the cooldown section of the Dependabot options reference.
janhoy
commented
Oct 24, 2026
The workflow regenerated dependency_licenses.csv on every Dependabot Go bump and pushed a fix-up commit. In practice most bumps do not need it: of the four open Dependabot PRs, only apache#845 fails "make check-licenses", and only because a transitive dependency's license URL moved (golang.org/x/sync v0.21.0 -> v0.22.0). Regenerating the list by hand on the PRs that actually need it is simpler than carrying a workflow that pushes commits to PR branches and re-dispatches checks. This leaves the PR as just the Dependabot configuration. Also reverts the workflow_dispatch triggers added to check.yaml and smoke-tests.yaml, which existed only so the removed workflow could re-run the checks after its fix-up push, and replaces the comment in dependabot.yml that referred to the workflow with a note on the manual step.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In our other repos we do monthly dependabot updates. This PR proposes the same for operator.
Configure Dependabot version updates for GitHub Actions and Go modules on a monthly schedule with a 7 day cooldown. Updates are grouped (one group for all actions; kubernetes/helm, cert-manager, testing, golang-x and a catch-all for Go) so that a month of bumps arrives as a handful of PRs. Security updates for Go are grouped as well. zookeeper-operator is ignored since its version is pinned across Makefile, Helm chart and docs.