opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-21 20:51:01 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: add dependabot security backport labels (#24484)

Browse Source 
Dependabot security update PRs should be backported with the workflow
added in #24025, but today they still rely on someone noticing and
adding the backport label manually.

This updates the dependabot workflow to add the existing backport label
automatically when a newly opened Dependabot PR looks like a security
fix, and it adjusts the Slack notification text so those PRs are called
out explicitly.
This commit is contained in:
Lukasz
2026-04-23 08:58:53 +05:00
committed by GitHub
parent 73857222ab
commit 06d7fc5200
1 changed files with 24 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/dependabot.yaml
+24 -1
View File
@@ -26,6 +26,24 @@ jobs:
uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 # v3.0.0
with:
github-token: "${{ secrets.GITHUB_TOKEN }}"
alert-lookup: true
- name: Add backport label to security updates
id: security_backport
if: >-
${{
steps.metadata.outputs.alert-state != '' &&
!contains(github.event.pull_request.labels.*.name, 'backport')
}}
run: |
set -euo pipefail
echo "Adding backport label to security update PR $PR_URL"
gh pr edit "$PR_URL" --add-label backport
echo "added=true" >> "$GITHUB_OUTPUT"
env:
PR_URL: ${{ github.event.pull_request.html_url }}
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Approve the PR
if: steps.metadata.outputs.package-ecosystem != 'github-actions'
@@ -47,7 +65,11 @@ jobs:
- name: Send Slack notification
run: |
if [ "$PACKAGE_ECOSYSTEM" = "github-actions" ]; then
if [ "$SECURITY_BACKPORT" = "true" ] && [ "$PACKAGE_ECOSYSTEM" = "github-actions" ]; then
STATUS_TEXT=":rotating_light: Dependabot opened security PR #${PR_NUMBER} and added the backport label (GitHub Actions changes are not auto-merged)"
elif [ "$SECURITY_BACKPORT" = "true" ]; then
STATUS_TEXT=":rotating_light: Auto merge enabled for Dependabot security PR #${PR_NUMBER}; backport label added"
elif [ "$PACKAGE_ECOSYSTEM" = "github-actions" ]; then
STATUS_TEXT=":pr-opened: Dependabot opened PR #${PR_NUMBER} (GitHub Actions changes are not auto-merged)"
else
STATUS_TEXT=":pr-merged: Auto merge enabled for Dependabot PR #${PR_NUMBER}"
@@ -92,6 +114,7 @@ jobs:
env:
SLACK_WEBHOOK: ${{ secrets.DEPENDABOT_PRS_SLACK_WEBHOOK }}
PACKAGE_ECOSYSTEM: ${{ steps.metadata.outputs.package-ecosystem }}
SECURITY_BACKPORT: ${{ steps.security_backport.outputs.added || 'false' }}
PR_NUMBER: ${{ github.event.pull_request.number }}
PR_TITLE: ${{ github.event.pull_request.title }}
PR_URL: ${{ github.event.pull_request.html_url }}