feat: enhance-dependabot

[kalverra]

Intent

Dependabot PRs stay unmergeable when follow-up steps (go mod tidy, codegen, formatting) must run after a bump; enhance-dependabot runs a repo-defined command on the PR head, commits the result, and pushes it back to the Dependabot branch so the usual PR checks re-run on merge-ready code.

Notes

• Callers use pull_request_target gated on github.actor == 'dependabot[bot]' and check out github.event.pull_request.head.sha with persist-credentials: false; validate.sh enforces all of it (actor, in-repo dependabot/* branch, HEAD, no persisted credentials) and fails closed.
• Pass a GitHub App token as push-token: GITHUB_TOKEN pushes do not trigger workflow runs. Credential isolation from the enhance command is best-effort (same job); see Known tradeoffs.
• Once enhanced, @dependabot rebase is refused (non-Dependabot commits); use @dependabot recreate.

Usage

A consumer repository adds .github/workflows/enhance-dependabot.yml (full options in the README):

name: enhance-dependabot

on:
  pull_request_target:
    types: [opened, synchronize, reopened]

permissions: {}

jobs:
  enhance:
    if: github.actor == 'dependabot[bot]'
    runs-on: ubuntu-latest
    timeout-minutes: 30
    # A Dependabot rebase cancels the in-progress run for the old head.
    concurrency:
      group: enhance-dependabot-${{ github.event.pull_request.number }}
      cancel-in-progress: true
    permissions:
      contents: read # push-token pushes; use write if push-token is GITHUB_TOKEN
      pull-requests: write # comment on the PR
    steps:
      # The PR head, not the merge ref, with no credentials left on disk.
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          persist-credentials: false

      # Whatever setup the enhance command needs.
      - uses: actions/setup-go@v7
        with:
          go-version-file: go.mod

      # App token push re-runs your PR checks; GITHUB_TOKEN pushes do not.
      - uses: actions/create-github-app-token@v2
        id: app-token
        with:
          app-id: ${{ secrets.ENHANCE_DEPENDABOT_APP_ID }}
          private-key: ${{ secrets.ENHANCE_DEPENDABOT_APP_PRIVATE_KEY }}

      - uses: smartcontractkit/.github/actions/enhance-dependabot@enhance-dependabot/v1
        with:
          enhance-command: go mod tidy && make generate
          push-token: ${{ steps.app-token.outputs.token }}

Changes

Enhancement flow from PR trigger to push:

flowchart TD
  T["pull_request_target (actor: dependabot)"] --> V["validate.sh: actor, branch, HEAD, no persisted creds"]:::new
  V --> E["Run enhance-command"]:::new
  E -- "no changes" --> S["Quiet success"]:::new
  E -- "changes" --> C["Commit as github-actions[bot]"]:::new
  C --> P["push.sh: hardened push via push-token"]:::new
  P -- "pushed" --> D["Comment; App-token push re-runs CI"]:::new
  P -- "branch moved" --> X["Superseded: exit 0, newer run enhances"]:::new
  P -- "rejected" --> F["Comment & Slack alert, fail"]:::new
  classDef new fill:#d4f8d4,stroke:#2da44e

Loading

Push ignores git config and hooks planted by the enhance command

• push.sh drops
  local url/http/credential/include config, ignores global/system
  config, and disables hooks before pushing.

A moved branch supersedes the run instead of replaying stale output

• push.sh exits 0
  with result=superseded; the README example adds a per-PR
  concurrency group.

Guard and push scripts are unit tested

• test.sh runs both scripts
  against throwaway git fixtures and a local bare remote
  (pnpm --filter enhance-dependabot test).

Consumer docs, outputs, and release metadata

• README.md covers the consumer
  workflow (App token, read-only job token), grouping, and tradeoffs.
• Outputs changed and
  commit-sha (set only
  when pushed); major-release
  changeset.

Merge Danger

	Rating	Why
Revert	🟢 trivial	New standalone action; no workflow in this repo or downstream consumes it.
Blast radius	🟢 small	Changes are confined to actions/enhance-dependabot/; opt-in per repository.

[github-actions]

👋 kalverra, thanks for creating this pull request!

To help reviewers, please consider creating future PRs as drafts first. This allows you to self-review and make any final changes before notifying the team.

Once you're ready, you can mark it as "Ready for review" to request feedback. Thanks!

[github-actions]

🦋 Changeset is good to go

Latest commit: b25b171

We got this.

Not sure what this means? Click here to learn what changesets are.

[Copilot]

🔵 Needs a closer look

Executing PR-controlled commands with write credentials requires a human security review of the trust boundary.

6 open findings

• Isolate write credentials from untrusted PR code · New
• Validate PR head SHA before detecting or committing changes · New
• Expose private dependency credentials through an explicit interface · New
• Skip enhancement when setup fails · New
• Treat an already-pushed enhancement as a successful retry · New
• Report the successful retry commit SHA · New

What changed in this PR

This PR adds a versioned reusable workflow for running repository-specific setup and generation on Dependabot PRs, then committing the resulting changes.

Changes:

• Adds checkout, enhancement, push retry, and failure reporting.
• Documents consumer setup and prepares the workflow for release.

File	Description
workflows/​enhance-dependabot/​README.md	Documents the reusable workflow and its inputs.
workflows/​enhance-dependabot/​package.json	Adds release package metadata.
workflows/​enhance-dependabot/​enhance-dependabot.yml	Implements the workflow.
workflows/​enhance-dependabot/​CHANGELOG.md	Starts the changelog.
.github/​workflows/​enhance-dependabot.yml	Publishes the generated workflow.
.changeset/​lucky-pumas-enhance.md	Declares the initial release.

🧠 Review effort: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Running PR-controlled code with write credentials needs a human-reviewed trust boundary.

3 open findings

• Untrusted PR code can misuse the persisted write-capable credential · New
• Default GITHUB_TOKEN prevents pushed changes from triggering PR checks · New
• Empty cherry-pick is incorrectly reported as a push failure · New

6 resolved since last review

• Validate PR head SHA before detecting or committing changes
• Isolate write credentials from untrusted PR code
• Report the successful retry commit SHA
• Treat an already-pushed enhancement as a successful retry
• Skip enhancement when setup fails
• Expose private dependency credentials through an explicit interface

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

🧠 Review effort: Lite