github-featured / comet-ml--opik

发布

0 发布 8,340 Git 标签

RSS 订阅源
  • 2.2.8-6163 d2b04767a8
    比较

    [OPIK-7494] [GHA] chore: add Dependabot coverage for CI/test-tooling deps (#7622)

    frostbyte_neo 发布于 2026-07-27 17:32:28 +00:00

    • [OPIK-7494] [INFRA] chore: add Dependabot coverage for CI/test-tooling deps

    Adds github-actions (all workflows), plus pip/npm blocks for the CI and
    test-tooling dirs (tests_load, test-helper-service, e2e, visual-tests).
    Production-image manifests (apps/) and SDK releases (sdks/) are left
    off by design. github-actions groups minor/patch and lets each major bump
    come as its own attributable PR; the existing maven block is unchanged.

    The stale actions surfaced by the Node 20 deprecation (setup-python,
    cache, login-action) plus the wider backlog of major bumps are left to
    Dependabot's first post-merge run rather than hand-swept.

    Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

    • chore(dependabot): trim to PR-exercised scopes

    Baz flagged that the "caught pre-merge" safety claim didn't hold: root
    tests_load/requirements.txt is installed by no workflow, load_tests.yml is
    schedule/dispatch-only (not pull_request), and visual-tests + test-helper-service
    have no workflow at all. Only tests_end_to_end/e2e is genuinely exercised on PRs
    (end2end_suites_v2.yml, npm ci + Playwright).

    Drop the four unexercised pip/npm blocks; keep github-actions + the e2e npm block;
    rewrite the safety comment to state the pull_request-exercised requirement.

    Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

    • ci(pr-lint): skip linter for Dependabot PRs

    Dependabot's bot-generated title/body can't follow the PR template, so
    pr-lint would fail on every Dependabot PR (~25 red checks once this config
    lands). Guard the lint-pr job with if: github.actor != 'dependabot[bot]'.

    The dependencies label is already applied by the existing labeler.yml
    (pull_request_target, matches package.json/requirements.txt), so no label
    config is added to dependabot.yml.

    Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

    • fix(pr-lint): gate on PR author, not github.actor

    github.actor is the user who triggered the run, so a human editing a
    Dependabot PR (edited/synchronize) would make the actor the human and let
    pr-lint run on the bot PR anyway. Key off github.event.pull_request.user.login
    instead — stable regardless of who triggered the run — mirroring the
    convention in pr-auto-assign.yml.

    Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

    Co-authored-by: Claude Opus 4.8 (1M context) noreply@anthropic.com

    下载附件