Compliance: non-stub-dependabot-rebase.yml #1392

Activity

1. don-petry

   added

   compliance-auditAutomated compliance audit findingAutomated compliance audit finding

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   on Jul 31, 2026
2. don-petry commented on Jul 31, 2026

   

   don-petry

   on Jul 31, 2026

   CollaboratorAuthor

   More actions

   Dev-Lead Implementation Plan

   Issue: #1392 — Compliance: non-stub-dependabot-rebase.yml

   Scope

   Repin the dependabot-rebase.yml thin caller stub from the drifted bare-tier @dependabot-rebase/stable to the org-standard major-scoped channel this ring-0 repo tracks — @dependabot-rebase/v2-next (analogous to the existing dependabot-automerge.yml@dependabot-automerge/v2-next pin), and add a regression test guarding it.

   Implementation Checklist

   • .github/workflows/dependabot-rebase.yml — change the uses: pin to @dependabot-rebase/v2-next; update the "READ BEFORE EDITING" header comment channel name to match. NOTE: intentionally NOT copying the canonical template verbatim, because the template's schedule.cron is 0 */4 * * * (minute-0), which the repo-local "Scheduled workflows" standard forbids and validate-workflow-schedules would fail. The existing staggered 15 */4 * * * offset is preserved.

   Tests to Write

   • tests/test_dependabot.bats — add rebase-stub tests mirroring the existing automerge ones: (a) file exists, (b) pins @dependabot-rebase/v2-next, (c) rejects off-channel pins (@vN, raw SHAs, stable/ring[0-9]).

   Test Command

   bats tests/test_dependabot.bats (full suite: bats tests/); lint: bash .dev-lead/scripts/dev-lead-lint.sh + bash scripts/validate-workflow-schedules.sh
3. don-petry commented on Jul 31, 2026

   

   don-petry

   on Jul 31, 2026

   CollaboratorAuthor

   More actions

   Dev-Lead: Implementation Complete

   Plan Execution

   • Repinned .github/workflows/dependabot-rebase.yml from the drifted bare-tier @dependabot-rebase/stable to the major-scoped next-ring channel @dependabot-rebase/v2-next
   • Updated the "READ BEFORE EDITING" header comment to name the actual channel (v2-next) and note this is a ring-0 repo
   • Added three regression tests to tests/test_dependabot.bats guarding the pin (exists / on-channel / off-channel)

   Design note (deviation from verbatim copy)

   The remediation suggests copying standards/workflows/dependabot-rebase.yml verbatim. Two adjustments were required so the file is valid for this repo rather than for a generic stable-ring consumer:

   1. Channel: the canonical template ships @dependabot-rebase/v2-stable, but this repo is the ring-0 dogfood consumer and tracks the next ring — exactly as its sibling dependabot-automerge.yml pins @dependabot-automerge/v2-next. The finding itself specifies the target as @dependabot-rebase/v<M>-next, i.e. v2-next here.
   2. Cron: the canonical template uses schedule.cron: '0 */4 * * *' (minute-0). The repo-local "Scheduled workflows" standard (AGENTS.md) forbids minute-0 crons and the validate-workflow-schedules CI gate would fail on it. The existing staggered '15 */4 * * *' offset was preserved.

   The finding is specifically about the uses: pin being off the major-scoped channel; that is corrected, and no other stub content was altered.

   Test Results

   $ npx bats tests/test_dependabot.bats
   1..13
   ok 1 dependabot.yml exists
   ok 2 dependabot.yml has github-actions ecosystem
   ok 3 dependabot.yml has security label (compliance-audit check)
   ok 4 dependabot.yml has dependencies label (compliance-audit check)
   ok 5 dependabot.yml github-actions entry has open-pull-requests-limit: 10
   ok 6 dependabot.yml schedule is weekly
   ok 7 dependabot-automerge.yml exists
   ok 8 dependabot-automerge.yml pins the reusable to the next ring channel (compliance-audit check)
   ok 9 dependabot-automerge.yml does not reference an off-channel pin
   ok 10 dependabot-automerge.yml triggers on pull_request_target
   ok 11 dependabot-rebase.yml exists
   ok 12 dependabot-rebase.yml pins the reusable to the next ring channel (compliance-audit check)
   ok 13 dependabot-rebase.yml does not reference an off-channel pin
   
   $ bash .dev-lead/scripts/dev-lead-lint.sh
     [lint] shellcheck on 98 file(s)...
     [lint] validating 4 agent profile(s)...
     [lint] all checks passed
   
   $ bash scripts/validate-workflow-schedules.sh
   schedule-lint: OK — no minute-0 (top-of-hour) scheduled crons found.
   
   $ bash scripts/validate-caller-inputs.sh          # exit 0 (rebase stub has no with:-forward; cross-repo soft-pass)
   $ bash tests/test_sonar_s7637_exemption.sh         # PASS — NOSONAR annotation preserved, 10 stubs
   

   Files Changed

   • .github/workflows/dependabot-rebase.yml: repin uses: to @dependabot-rebase/v2-next; header-comment channel name updated to match.
   • tests/test_dependabot.bats: +3 regression tests + REBASE_YML/REBASE_CHANNEL vars, mirroring the existing automerge guards.

   Notes

   Deliberately did not copy the template's minute-0 cron (would violate the repo-local schedule standard) — see design note. No behavioral change to the rebase/merge logic (that lives in the central reusable). No follow-ups required.
4. don-petry

   added a commit that references this issue on Jul 31, 2026

   feat: implement issue #1392 — Compliance: non-stub-dependabot-rebase.…

   ...

   4c448fa
5. don-petry

   closed this as completedin #1396on Jul 31, 2026