Skip to content

fix: harden Dependabot automation#310

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Pigbibi merged 3 commits into from
Aug 11, 2026
Merged

fix: harden Dependabot automation #310

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
66600c9
fix: harden Dependabot automation
Pigbibi Aug 11, 2026
5f7299d
fix: retain disabled workflow tombstone
Pigbibi Aug 11, 2026
ca729ad
fix: preserve sensitive path ownership
Pigbibi Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion .github/CODEOWNERS
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1 +1,11 @@
* @Pigbibi
# Limit automatic review requests to order and risk-sensitive changes.
/.github/CODEOWNERS @Pigbibi
/src/quant_platform_kit/risk/ @Pigbibi
/src/quant_platform_kit/binance/ @Pigbibi
/src/quant_platform_kit/ibkr/ @Pigbibi
/src/quant_platform_kit/longbridge/ @Pigbibi
/src/quant_platform_kit/schwab/ @Pigbibi
Comment thread
Pigbibi marked this conversation as resolved.
/src/quant_platform_kit/common/models.py @Pigbibi
/src/quant_platform_kit/common/port_adapters.py @Pigbibi
/src/quant_platform_kit/common/execution_translation.py @Pigbibi
/src/quant_platform_kit/position_sizing.py @Pigbibi

@chatgpt-codex-connectorchatgpt-codex-connectorBotAug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Cover remaining shared execution modules

The fresh evidence in this revision is that the expanded allowlist still stops after four shared files, while a repo-wide search shows other unowned order-critical modules: common/ports.py:23 defines the core submit_order port, common/execution_state.py:164 detects prior executions, and common/order_status.py:130 normalizes execution reports. When a PR changes any of these modules, GitHub will request no code-owner review and cannot require code-owner approval, despite the stated order-sensitive scope; add ownership patterns for the remaining shared execution paths.

Useful? React with 👍 / 👎.

12 changes: 9 additions & 3 deletions .github/workflows/dependabot_auto_merge.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -43,7 +43,7 @@ jobs:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
set -euo pipefail
gh pr view "${{ steps.pr.outputs.pr_number }}" --repo "${GITHUB_REPOSITORY}" --json number,isDraft,author,url,body,labels > pr.json
gh pr view "${{ steps.pr.outputs.pr_number }}" --repo "${GITHUB_REPOSITORY}" --json number,isDraft,author,url,title,body,labels > pr.json
python3 - <<'PY'
import json
import os
Expand All@@ -52,15 +52,20 @@ jobs:
pr = json.loads(Path("pr.json").read_text(encoding="utf-8"))
author = (pr.get("author") or {}).get("login")
labels = {item.get("name", "") for item in pr.get("labels", [])}
title = pr.get("title") or ""
body = pr.get("body") or ""
is_major = "update-type: version-update:semver-major" in body
sensitive_labels = {"docker", "github_actions"}
is_sensitive = bool(labels & sensitive_labels) or "QuantStrategyLab/" in title or "QuantStrategyLab/" in body
dependabot_authors = {"dependabot[bot]", "app/dependabot"}
is_dependabot = author in dependabot_authors and "dependencies" in labels
should_merge = is_dependabot and not pr.get("isDraft") and not is_major
should_merge = is_dependabot and not pr.get("isDraft") and not is_major and not is_sensitive
if should_merge:
reason = "ready"
elif is_major:
reason = "major_update"
elif is_sensitive:
reason = "sensitive_dependency_update"
else:
reason = "not_eligible_dependabot_pr"

Expand All@@ -71,6 +76,7 @@ jobs:
f"- Draft: `{'yes' if pr.get('isDraft') else 'no'}`",
f"- Dependabot label: `{'yes' if 'dependencies' in labels else 'no'}`",
f"- Major update: `{'yes' if is_major else 'no'}`",
f"- Sensitive dependency class: `{'yes' if is_sensitive else 'no'}`",
f"- Final merge decision: `{'merge' if should_merge else 'skip'}`",
f"- Reason: `{reason}`",
]
Expand All@@ -88,4 +94,4 @@ jobs:
if: steps.merge_guard.outputs.should_merge == 'true'
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: gh pr merge "${{ steps.pr.outputs.pr_number }}" --repo "${GITHUB_REPOSITORY}" --rebase --delete-branch --match-head-commit "${{ steps.pr.outputs.head_sha }}"
run: gh pr merge "${{ steps.pr.outputs.pr_number }}" --repo "${GITHUB_REPOSITORY}" --auto --rebase --delete-branch --match-head-commit "${{ steps.pr.outputs.head_sha }}"
4 changes: 2 additions & 2 deletions .github/workflows/dependabot_review_request_cleanup.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
name: Dismiss Dependabot Review Request

# Disabled tombstone: automatic cleanup cannot retract an already-sent review notification.
"on":
pull_request_target:
types: [review_requested]
workflow_dispatch:

permissions:
contents: read
Expand Down