update cagent-action to latest (with better permissions) by derekmisler · Pull Request #13665 · docker/compose

derekmisler · 2026-03-24T19:21:48Z

What I did

Upgrade docker/cagent-action from v1.2.13 to v1.3.1 and simplify the PR review workflow.

Key changes:

Bump cagent-action ref to dba0ca51…@v1.3.1, which handles filtering logic (draft PRs, bot actors, collaborator checks) internally — removing ~20 lines of hand-rolled if conditions from the workflow.
Switch trigger from pull_request_target to pull_request — the new action version manages fork PR security itself, so pull_request_target is no longer needed. Fork PRs can still be reviewed via the /review comment command.
Add top-level permissions: contents: read so issue_comment-triggered runs can access secrets, and scope remaining permissions to the review job to follow least-privilege.
Remove concurrency block — the updated action handles review serialization internally.
Add inline comments on secrets and triggers for easier onboarding.

Related issue

Closes: https://github.com/docker/gordon/issues/272

(not mandatory) A picture of a cute animal, if possible in relation to what you did

🤖🐙 (an AI octopus reviewing pull requests)

derekmisler · 2026-03-24T19:24:44Z

-# Serialize reviews per PR; do not cancel in-progress runs
-# so no review is silently dropped mid-execution.
-concurrency:
- group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number }}
- cancel-in-progress: false


This is already baked into the action.

derekmisler · 2026-03-24T19:25:23Z

- # Only run on the upstream repo (not forks) to prevent credential leaks.
- # Skip draft PRs (ready_for_review will fire when promoted).
- # Skip bot actors to avoid reviewing Dependabot and automation PRs.
- # Require collaborator-level access for comment-triggered events.
- # Only trigger on PR comments, not plain issue comments.
- if: >-
- github.repository == 'docker/compose' &&
- (github.event_name != 'pull_request_target' || github.event.pull_request.draft == false) &&
- (github.event_name == 'pull_request_target' ||
- (github.event_name == 'issue_comment' &&
- github.event.issue.pull_request &&
- contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||
- (github.event_name == 'pull_request_review_comment' &&
- contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association))) &&
- !endsWith(github.actor, '[bot]')


This is also now included in the action.

Signed-off-by: Derek Misler <derek.misler@docker.com>

Copilot

Pull request overview

Updates the PR review automation workflow to use the latest docker/cagent-action reusable workflow and simplifies the workflow logic by relying on the action’s built-in filtering/serialization.

Changes:

Bump docker/cagent-action reusable workflow pin to v1.3.1.
Switch auto-review trigger from pull_request_target to pull_request, keeping /review via issue_comment.
Add top-level permissions: contents: read and scope job-level permissions explicitly; remove prior workflow-level if gating and concurrency.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Derek Misler <derekmisler@gmail.com>

codecov · 2026-03-24T19:52:51Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [docker/compose](https://github.com/docker/compose) | patch | `v5.1.1` → `v5.1.2` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>docker/compose (docker/compose)</summary> ### [`v5.1.2`](https://github.com/docker/compose/releases/tag/v5.1.2) [Compare Source](docker/compose@v5.1.1...v5.1.2) #### What's Changed ##### 🐛 Fixes - Fix TTY timer rendering when duration length changes by [@MaybeSam05](https://github.com/MaybeSam05) in [#13634](docker/compose#13634) - Fix up attach filtering by [@false200](https://github.com/false200) in [#13664](docker/compose#13664) - Preserve ssh:// URL scheme when resolving Dockerfile path by [@ssam18](https://github.com/ssam18) in [#13669](docker/compose#13669) - Initialize and pass envFiles map in processExtends by [@Mohamed-Moumni](https://github.com/Mohamed-Moumni) in [#13678](docker/compose#13678) - Fix TestRunHook\_ConsoleSize on macOS by [@thaJeztah](https://github.com/thaJeztah) in [#13686](docker/compose#13686) - Restore post-connect fallback for multi-network stacks on API < 1.44 by [@jotka](https://github.com/jotka) in [#13629](docker/compose#13629) - Publish: return api.ErrCanceled when user declines interactive prompts by [@ishwar170695](https://github.com/ishwar170695) in [#13674](docker/compose#13674) - Return error on non-ErrNotExist stat failures in Tar.Sync() by [@Lidang-Jiang](https://github.com/Lidang-Jiang) in [#13684](docker/compose#13684) ##### 🔧 Internal - Refactor: thread context through publish sensitive data check by [@ishwar170695](https://github.com/ishwar170695) in [#13653](docker/compose#13653) - Add AI-powered MR review workflow via `docker/cagent-action` by [@glours](https://github.com/glours) in [#13659](docker/compose#13659) - Update `cagent-action` to latest (with better permissions) by [@derekmisler](https://github.com/derekmisler) in [#13665](docker/compose#13665) - Pin GitHub Actions to commit SHA, remove pr-review workflow by [@glours](https://github.com/glours) in [#13662](docker/compose#13662) - Exclude hook\_test.go from Windows builds and propagate ExecStart error in runWaitExec by [@pawannn](https://github.com/pawannn) in [#13683](docker/compose#13683) - Skip MR review workflow for Dependabot MRs by [@glours](https://github.com/glours) in [#13679](docker/compose#13679) - Use negotiated API version for network setup by [@glours](https://github.com/glours) in [#13690](docker/compose#13690) - Fix mixed assertion libraries in tests by [@thaJeztah](https://github.com/thaJeztah) in [#13689](docker/compose#13689) - Test: use random host port for dind TLS build test by [@ricardobranco777](https://github.com/ricardobranco777) in [#13630](docker/compose#13630) - Remove direct dependency on `docker/docker` by [@glours](https://github.com/glours) in [#13706](docker/compose#13706) ##### ⚙️ Dependencies - Bump github.com/containerd/platforms from `1.0.0-rc.2` to `1.0.0-rc.3` by [@dependabot](https://github.com/dependabot)\[bot] in [#13657](docker/compose#13657) - Bump golangci-lint to `v2.11.3` and configure CLAUDE to use it on change by [@ndeloof](https://github.com/ndeloof) in [#13656](docker/compose#13656) - Bump google.golang.org/grpc from `1.78.0` to `1.79.3` by [@dependabot](https://github.com/dependabot)\[bot] in [#13642](docker/compose#13642) - Bump github.com/moby/patternmatcher from `0.6.0` to `0.6.1` by [@dependabot](https://github.com/dependabot)\[bot] in [#13667](docker/compose#13667) - Bump go.opentelemetry.io/otel/sdk from `1.39.0` to `1.42.0` by [@glours](https://github.com/glours) in [#13663](docker/compose#13663) - Bump github.com/docker/cli from `29.2.1+incompatible` to `29.3.1+incompatible` by [@dependabot](https://github.com/dependabot)\[bot] in [#13670](docker/compose#13670) - Bump github.com/hashicorp/go-version from `1.8.0` to `1.9.0` by [@dependabot](https://github.com/dependabot)\[bot] in [#13692](docker/compose#13692) - Bump github.com/docker/buildx `v0.33.0`, buildkit `v0.29.0` by [@thaJeztah](https://github.com/thaJeztah) in [#13693](docker/compose#13693) - Bump google.golang.org/grpc from `1.79.3` to `1.80.0` by [@dependabot](https://github.com/dependabot)\[bot] in [#13697](docker/compose#13697) - Bump github.com/containerd/platforms from `1.0.0-rc.3` to `1.0.0-rc.4` by [@dependabot](https://github.com/dependabot)\[bot] in [#13696](docker/compose#13696) - Bump github.com/moby/moby/client `v0.4.0`, moby/api `v1.54.1` by [@thaJeztah](https://github.com/thaJeztah) in [#13708](docker/compose#13708) - Bump github.com/docker/cli `v29.4.0` by [@thaJeztah](https://github.com/thaJeztah) in [#13707](docker/compose#13707) - Bump compose-go to version `v2.10.2` by [@glours](https://github.com/glours) in [#13705](docker/compose#13705) - Bump to Go `1.25.9` by [@thaJeztah](https://github.com/thaJeztah) in [#13720](docker/compose#13720) #### New Contributors - [@MaybeSam05](https://github.com/MaybeSam05) made their first contribution in [#13634](docker/compose#13634) - [@ishwar170695](https://github.com/ishwar170695) made their first contribution in [#13653](docker/compose#13653) - [@derekmisler](https://github.com/derekmisler) made their first contribution in [#13665](docker/compose#13665) - [@false200](https://github.com/false200) made their first contribution in [#13664](docker/compose#13664) - [@ssam18](https://github.com/ssam18) made their first contribution in [#13669](docker/compose#13669) - [@Mohamed-Moumni](https://github.com/Mohamed-Moumni) made their first contribution in [#13678](docker/compose#13678) - [@pawannn](https://github.com/pawannn) made their first contribution in [#13683](docker/compose#13683) - [@jotka](https://github.com/jotka) made their first contribution in [#13629](docker/compose#13629) - [@Lidang-Jiang](https://github.com/Lidang-Jiang) made their first contribution in [#13684](docker/compose#13684) **Full Changelog**: <docker/compose@v5.1.1...v5.1.2> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever MR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

derekmisler commented Mar 24, 2026
View reviewed changes

update cagent-action to latest (with better permissions)
4b44171
Signed-off-by: Derek Misler <derek.misler@docker.com>

derekmisler force-pushed the update-cagent-action-to-latest-with-better-permis branch from 4417b26 to 4b44171Compare March 24, 2026 19:32

derekmisler marked this pull request as ready for review March 24, 2026 19:32

derekmisler requested a review from a team as a code owner March 24, 2026 19:33

derekmisler requested review from Copilot, glours and ndeloof March 24, 2026 19:33

Copilotstarted reviewing on behalf of derekmisler March 24, 2026 19:33 View session

CopilotAI reviewed Mar 24, 2026
View reviewed changes

Comment thread.github/workflows/pr-review.yml
Comment thread.github/workflows/pr-review.yml
Comment thread.github/workflows/pr-review.yml Outdated
Comment thread.github/workflows/pr-review.yml Outdated

derekmislerand others added 2 commits March 24, 2026 15:39

Update .github/workflows/pr-review.yml
c0803d3
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Derek Misler <derekmisler@gmail.com>

Update .github/workflows/pr-review.yml
02f9e0f
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Derek Misler <derekmisler@gmail.com>

glours approved these changes Mar 25, 2026
View reviewed changes

glours merged commit 46d75d0 into docker:mainMar 25, 2026
40 checks passed

BrewTestBot mentioned this pull request Apr 9, 2026
docker-compose 5.1.2 Homebrew/homebrew-core#276795
Merged

rancherbot mentioned this pull request Apr 10, 2026
rddepman: bump dockerCompose from 5.1.1 to 5.1.2 rancher-sandbox/rancher-desktop#10124
Merged

Navigation Menu

Uh oh!

update cagent-action to latest (with better permissions) - #13665

update cagent-action to latest (with better permissions)#13665
glours merged 3 commits into
docker:mainfrom
derekmisler:update-cagent-action-to-latest-with-better-permis

derekmisler commented Mar 24, 2026•
edited
Loading

Uh oh!

derekmislerMar 24, 2026

Uh oh!

derekmislerMar 24, 2026

Uh oh!

CopilotAI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecovBot commented Mar 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

derekmisler commented Mar 24, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

derekmislerMar 24, 2026

Choose a reason for hiding this comment

Uh oh!

derekmislerMar 24, 2026

Choose a reason for hiding this comment

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecovBot commented Mar 24, 2026

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

derekmisler commented Mar 24, 2026•
edited
Loading