feat: add reusable renovate-auto-approve workflow - #25
Open
cbrgm wants to merge 2 commits into
Open
Conversation
Reusable workflow_call workflow that approves Renovate PRs labeled automerge (and not security) via the gh CLI, and revokes its own prior approval if a PR later gains the security label. Ships an example caller under example/.github/workflows and a NEW_REPO onboarding note. The automerge policy (which update types are eligible) stays in the renovate-config presets; this repo hosts the workflow that acts on it, alongside the existing repo-settings governance.
📝 WalkthroughWalkthroughThis change adds a reusable GitHub Actions workflow for conditional Renovate pull request approval. It adds an example caller workflow and documents required permissions, status checks, update eligibility, and setup steps. ChangesRenovate auto-approval
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant GitHub as GitHub pull request
participant Caller as Example workflow
participant Reusable as Reusable workflow
participant Reviews as GitHub reviews
GitHub->>Caller: opened, reopened, synchronized, or labeled event
Caller->>Reusable: invoke with pull-request write permission
Reusable->>Reviews: inspect latest automated review
Reviews-->>Reusable: review state
Reusable->>Reviews: approve or request changes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
4 tasks
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/renovate-auto-approve.yml:
- Around line 41-45: Update the workflow around the review mutation steps to
re-query current pull-request labels immediately before every gh pr review call,
preventing stale HAS_BLOCK state from approving blocked PRs. Configure
concurrency using the repository and pull request number, with
cancel-in-progress enabled, so overlapping runs for the same PR are serialized.
In `@example/.github/workflows/renovate-auto-approve.yml`:
- Around line 5-7: Update the pull_request event configuration to include the
unlabeled activity type alongside the existing opened, reopened, synchronize,
and labeled triggers, so removing the security label re-evaluates the workflow.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 1e60e05d-a9d0-4cd1-b421-83bff521d78d
📒 Files selected for processing (3)
.github/workflows/renovate-auto-approve.ymldocs/NEW_REPO.mdexample/.github/workflows/renovate-auto-approve.yml
Re-read the PR labels immediately before approving, so an approval started from a stale trigger payload does not land after the security label was added concurrently. Serialize runs per PR with a concurrency group and cancel-in-progress. The example caller also triggers on unlabeled so removing the security label re-evaluates the PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a reusable
renovate-auto-approve.ymlworkflow to dev-kit, plus an example caller and an onboarding note.Why
We want Renovate to auto-merge digest/patch/minor PRs without a manual approval. The renovate-config presets already set
automerge: trueand add anautomergelabel to those update types, but Renovate cant approve its own PRs, so the required-review gate never clears. This workflow provides the approval for labeled PRs and revokes it if a PR later turns out to be asecurityone.Originally i put this in renovate-config (opendefensecloud/renovate-config#14), but dev-kit is the better home: it already owns the shared CI workflows and the
repo-settingsgovernance (labels, merge strategy, theprotect-mainruleset). renovate-config keeps the policy (which update types are eligible), dev-kit hosts the workflow that acts on it. So renovate-config#14 now just points its caller at dev-kit.Context: opendefensecloud/solution-arsenal#580.
Testing
Linted the reusable workflow (the one that actually runs in this repo):
The
example/copy is a template (GitHub only runs workflows under.github/workflows/, notexample/...), so it never executes here. The@<sha-or-tag>ref is an intentional placeholder consumers pin when they copy it. End-to-end automerge can only be exercised on a real Renovate PR in a consuming repo with the GitHub settings applied.Notes for reviewers
make repo-settingsto also flip "Allow GitHub Actions to create and approve pull requests" so it isnt a manual step. Left out here to keep this PR focused. Can open an issue if we want it.Checklist
actionlint; no runtime harness for a reusable workflow in this repo)Summary by CodeRabbit
New Features
Documentation