Add centralized /dependabot-burner grouping and retry-aware single-workflow remediation by Copilot · Pull Request #40396 · github/gh-aw

Copilot · 2026-06-19T22:05:47Z

This updates dependabot-burner to support direct PR invocation via a centralized /dependabot-burner command and to drive a single grouped remediation attempt inside the burner workflow itself. It also teaches the burner to reuse signal from prior failed burner PRs and maintainer-only feedback when deciding the next retry shape. The old dependabot-campaign and dependabot-worker workflows have been removed — dependabot-burner is now the single workflow handling all Dependabot remediation.

Centralized PR entrypoint
- Adds a centralized slash_command trigger for /dependabot-burner on PR comments and review comments.
- Prefetches Dependabot PR context so slash-command runs can start from the triggering PR instead of scanning the full backlog blindly.
Filtered related-PR grouping
- Builds a grouped batch from PRs that touch the same generated manifest targets as the triggering PR.
- Posts a single status comment on slash-command runs when related PRs are grouped, so maintainers can quickly review the intended batch and spot unrelated items.
Retry-aware burner orchestration
- Scans recent closed unmerged [dependabot-burner] PRs and passes that history into the next attempt.
- Falls back cleanly when Dependabot PR titles do not match the strict bump-title pattern by preserving raw title context instead of dropping dependency identity.
Maintainer-only feedback loop
- Explicitly scopes retry guidance to maintainer/admin/write feedback and ignores non-maintainer noise.
- Distinguishes first-attempt vs retry flows so the burner can adapt behavior without widening scope.
Single-workflow remediation strategy
- Moves the remediation path into dependabot-burner so the burner owns source edits, validation, and replacement-PR creation in one workflow.
- Removes dependabot-campaign and dependabot-worker; their responsibilities are fully absorbed by dependabot-burner via inline subagents.
Subagent-based PR analysis and execution
- Adds burner-side subagents for PR-group validation, retry-history analysis, dependency-batch mapping, retry-feedback synthesis, and the single bounded remediation wave.

on:
slash_command:
strategy: centralizedname: dependabot-burnerevents: [pull_request_comment, pull_request_review_comment]safe-outputs:
create-pull-request:
title-prefix: "[dependabot-burner] "max: 1

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-06-19T22:54:29Z

@copilot merge dependabot worker into the dependabot burner as a sub agent. Single AW.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-06-19T23:14:57Z

@copilot merge dependabot worker into the dependabot burner as a sub agent. Single AW.

Addressed in fe94006. dependabot-burner now performs the remediation through inline subagents in the same workflow, and the compiled lock no longer dispatches to dependabot-worker.

pelikhan · 2026-06-20T01:05:28Z

@copilot remove the old agentic-workflows that handled dependent-bot tasks and keep only the new dependent-bot burner.

Copilot

Pull request overview

This PR evolves the Dependabot automation workflows to support a centralized /dependabot-burner slash-command entrypoint and to run a single grouped remediation wave within the burner workflow, incorporating retry history and maintainer-only feedback into subsequent attempts.

Changes:

Adds a /dependabot-burner centralized slash-command trigger and prefetches PR context to build a related-PR batch.
Introduces retry-aware inputs (retry context + maintainer feedback) and threads them through the existing worker/campaign dispatch plumbing.
Updates the burner workflow’s compiled lock manifest to support comment/PR safe-outputs, CLI proxy usage, and the new orchestration flow.

Show a summary per file

File	Description
.github/workflows/dependabot-worker.md	Adds retry/maintainer-feedback inputs and updates worker instructions/output fields for retry-aware execution.
.github/workflows/dependabot-worker.lock.yml	Regenerates the compiled workflow to include new inputs and updated safe-outputs title prefix.
.github/workflows/dependabot-campaign.lock.yml	Threads new retry/feedback inputs through the campaign → worker invocation payload in the compiled workflow.
.github/workflows/dependabot-burner.md	Replaces the burner definition with a centralized slash-command + grouped remediation orchestrator and subagents.
.github/workflows/dependabot-burner.lock.yml	Regenerates the compiled burner workflow with pre-activation role checks, safe-outputs, CLI proxy, and updated permissions.
.github/workflows/agentic_commands.yml	Registers `/dependabot-burner` routing to the new workflow.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 6/6 changed files
Comments generated: 2

+ async function listRecentClosedBurnerPRs() {
+ const pulls = await github.paginate(github.rest.pulls.list, {
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ state: 'closed',
+ per_page: 100,
+ });
+
+ return pulls
+ .filter((pull) => pull.title?.startsWith('[dependabot-burner] ') && !pull.merged_at)
+ .slice(0, 20)
+ .map((pull) => ({
+ number: pull.number,
+ title: pull.title,
+ body: pull.body || '',
+ url: pull.html_url,
+ closed_at: pull.closed_at,
+ created_at: pull.created_at,
+ }))
+ .sort((a, b) => new Date(b.closed_at || b.created_at).getTime() - new Date(a.closed_at || a.created_at).getTime());
+ }


+ async function loadPullFiles(pullNumber) {
+ const files = await github.paginate(github.rest.pulls.listFiles, {
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ pull_number: pullNumber,
+ per_page: 100,
+ });
+ return files.map((file) => file.filename).filter((filename) => manifestTargets.has(filename));
+ }


Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-06-20T01:20:05Z

@copilot remove the old agentic-workflows that handled dependent-bot tasks and keep only the new dependent-bot burner.

Done in the latest commit. Removed dependabot-campaign.md, dependabot-campaign.lock.yml, dependabot-worker.md, and dependabot-worker.lock.yml. dependabot-burner is now the single workflow handling all Dependabot remediation.

pelikhan · 2026-06-20T02:29:54Z

@copilot merge main

…abot-burner-support # Conflicts: # .github/workflows/agentic_commands.yml # .github/workflows/dependabot-burner.lock.yml # .github/workflows/dependabot-campaign.lock.yml # .github/workflows/dependabot-campaign.md # .github/workflows/dependabot-worker.lock.yml # .github/workflows/dependabot-worker.md Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-06-20T02:42:25Z

@copilot merge main

Done — merged origin/main and recompiled all workflows.

CopilotAIand others added 2 commits June 19, 2026 21:59

feat: update dependabot burner grouping flow
f466b94
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

feat: refine dependabot burner retry flow
3e84a5b
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

CopilotAI assigned Copilot and pelikhan Jun 19, 2026

CopilotAI changed the title ~~Update dependabot-burner slash-command grouping flow~~Add centralized /dependabot-burner grouping and retry-aware single-PR remediationJun 19, 2026

Copilotcreated this pull request from a session on behalf of pelikhan June 19, 2026 22:06 View session

CopilotAI requested a review from pelikhan June 19, 2026 22:06

Copilotfinished work on behalf of pelikhan June 19, 2026 22:06

Copilotstarted work on behalf of pelikhan June 19, 2026 22:54 View session

refactor: inline dependabot burner remediation
fe94006
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

CopilotAI changed the title ~~Add centralized /dependabot-burner grouping and retry-aware single-PR remediation~~Add centralized /dependabot-burner grouping and retry-aware single-workflow remediationJun 19, 2026

Copilotfinished work on behalf of pelikhan June 19, 2026 23:15

pelikhan marked this pull request as ready for review June 20, 2026 01:04

CopilotAI review requested due to automatic review settings June 20, 2026 01:04

Copilotstarted reviewing on behalf of pelikhan June 20, 2026 01:04 View session

CopilotAI reviewed Jun 20, 2026
View reviewed changes

Copilotstarted work on behalf of pelikhan June 20, 2026 01:11 View session

remove: delete old dependabot-campaign and dependabot-worker workflows
ecf390e
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilotfinished work on behalf of pelikhan June 20, 2026 01:20

github-actionsBot mentioned this pull request Jun 20, 2026
[aw] No-Op Runs #39849
Closed

pelikhan approved these changes Jun 20, 2026
View reviewed changes

Copilotstarted work on behalf of pelikhan June 20, 2026 02:30 View session

CopilotAIand others added 2 commits June 20, 2026 02:36

merge: merge main into branch and recompile workflows
f8b8116
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

CopilotAI requested a review from pelikhan June 20, 2026 02:42

Copilotfinished work on behalf of pelikhan June 20, 2026 02:42

pelikhan merged commit 9ad5040 into mainJun 20, 2026

pelikhan deleted the copilot/update-dependabot-burner-support branch June 20, 2026 02:56

github-actionsBot mentioned this pull request Jun 20, 2026
[team-status] Team Daily Status — 2026-06-20 #40461
Closed

Navigation Menu

Uh oh!

Add centralized /dependabot-burner grouping and retry-aware single-workflow remediation - #40396

Add centralized /dependabot-burner grouping and retry-aware single-workflow remediation#40396
pelikhan merged 6 commits into
mainfrom
copilot/update-dependabot-burner-support

CopilotAI commented Jun 19, 2026•
edited
Loading

Uh oh!

pelikhan commented Jun 19, 2026

Uh oh!

CopilotAI commented Jun 19, 2026

Uh oh!

pelikhan commented Jun 20, 2026

Uh oh!

CopilotAI left a comment

Uh oh!

CopilotAI commented Jun 20, 2026

Uh oh!

pelikhan commented Jun 20, 2026

Uh oh!

CopilotAI commented Jun 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

CopilotAI commented Jun 19, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pelikhan commented Jun 19, 2026

Uh oh!

CopilotAI commented Jun 19, 2026

Uh oh!

pelikhan commented Jun 20, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

CopilotAI commented Jun 20, 2026

Uh oh!

pelikhan commented Jun 20, 2026

Uh oh!

CopilotAI commented Jun 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

CopilotAI commented Jun 19, 2026•
edited
Loading