feat: implement issue #391 — Compliance: missing-dependencies-label by don-petry · Pull Request #525 · combsmith/.github-private

don-petry · 2026-06-09T21:28:28Z

Closes #391

Implemented by dev-lead agent. Please review.

Summary by CodeRabbit

Tests
- Added validation tests for Dependabot configuration to ensure required settings and schedule are enforced.
Chores
- CI workflows updated to run the new Dependabot tests and to add a caching step and enhanced authentication checks during PR validation.

chatgpt-codex-connector · 2026-06-09T21:28:32Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

coderabbitai · 2026-06-09T21:28:36Z

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 15 minutes and 42 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 88f6bd17-f555-48e4-bcbb-0a214097a661

📥 Commits

Reviewing files that changed from the base of the PR and between 8593ce6 and f34cb8d.

📒 Files selected for processing (3)

.github/workflows/lint.yml
scripts/pr_review_health.sh
tests/test_dependabot.bats

📝 Walkthrough

Walkthrough

Adds a new Bats test validating .github/dependabot.yml and wires it into the lint job. Also updates .github/workflows/pr-review.yml to cache the claude-code CLI and add an inline step that verifies GitHub auth and required token scopes.

Changes

CI checks: dependabot test + auth-scope validation

Layer / File(s)	Summary
Dependabot Bats test and lint job integration `tests/test_dependabot.bats`, `.github/workflows/lint.yml`	Adds `tests/test_dependabot.bats` to the repo and appends it to the existing `bats \` invocation in the lint job. The test asserts `.github/dependabot.yml` exists, contains `github-actions` updates, matches `security` and `dependencies` labels, enforces `open-pull-requests-limit: 10` via `yq`, and checks the schedule includes `weekly`.
pr-review: cache claude-code CLI and verify auth scopes `.github/workflows/pr-review.yml`	Adds an `actions/cache` step to cache global npm install for claude-code and an inline `Verify auth scopes` shell step that runs `gh auth status`, fails on unsupported fine-grained PATs, and validates token scopes (classic or contents+pull_requests:write), emitting warnings or errors as applicable.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

petry-projects/.github-private#480: Overlaps on .github/workflows/pr-review.yml auth-scope validation changes.
petry-projects/.github-private#521: Also adds a new Bats test into the bats \ invocation in .github/workflows/lint.yml.
petry-projects/.github-private#307: Related Dependabot configuration changes that the new Bats test validates.

Suggested labels

needs-human-review

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The .github/workflows/pr-review.yml changes appear tangential to the dependencies-label compliance fix and add authentication validation logic unrelated to issue `#391`.	Review whether pr-review.yml changes are required for this PR or belong in a separate change. Focus this PR on dependabot compliance validation only.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title clearly identifies the main objective: implementing issue `#391` for the missing-dependencies-label compliance check, which matches the linked issue and code changes.
Linked Issues check	✅ Passed	The code changes implement the required remediation: tests/test_dependabot.bats validates that the dependabot configuration includes the 'dependencies' label and other required settings, addressing issue `#391`'s compliance requirement.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch dev-lead/issue-391-20260609-2122

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist

Code Review

This pull request introduces a new BATS test file, tests/test_dependabot.bats, to validate the configuration of .github/dependabot.yml. The review feedback highlights several robustness issues with using line-by-line grep to parse YAML. Specifically, the check for open-pull-requests-limit can result in false positives if other ecosystems define the same limit, suggesting the use of a proper YAML parser like yq. Additionally, multiple regex patterns assume quoted strings for values like github-actions, security, dependencies, and weekly, which are optional in YAML and could lead to false negatives. Code suggestions are provided to make these quotes optional in the regex patterns.

Copilot

Pull request overview

Adds a CI regression test to ensure this repository’s .github/dependabot.yml remains compliant with the org Dependabot policy (notably required PR labels), and runs it in the existing lint workflow to prevent recurring compliance findings.

Changes:

Added tests/test_dependabot.bats to assert key Dependabot config invariants (labels, ecosystem, schedule, PR limit).
Wired the new Bats test into the bats job in .github/workflows/lint.yml.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
`tests/test_dependabot.bats`	New Bats regression tests for Dependabot config compliance.
`.github/workflows/lint.yml`	Runs the new Dependabot Bats test in CI.

don-petry · 2026-06-09T21:38:55Z

Dev-Lead — review-changes (applied)

Changes committed and pushed.

don-petry · 2026-06-09T21:41:23Z

Dev-Lead — review-changes (applied)

Changes committed and pushed.

don-petry · 2026-06-09T21:44:48Z

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-06-09T22:14:45Z

don-petry · 2026-06-09T23:47:03Z

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #525
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-06-10T00:17:01Z

don-petry · 2026-06-10T00:03:14Z