fix(ci): keep bot dependency PRs labeled and rebased automatically - #2752
Merged
Conversation
Renovate PRs had no semver label at all (only Dependabot gets one via dependabot.yml), so every open Renovate PR failed the required "PR Semver Labels" check. Add the same no-release label Dependabot uses. Neither bot proactively rebases a clean PR just because main moved, so PRs sat BEHIND under our strict branch-protection setting until someone noticed. Renovate supports rebaseWhen natively; Dependabot doesn't, so add a Mergify rule to update bot PR branches once they fall behind. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Erik Osterman (Cloud Posse) (osterman)
requested a review
from a team
as a code owner
July 13, 2026 19:38
Erik Osterman (Cloud Posse) (osterman)
added
the
no-release
Erik Osterman (Cloud Posse) (osterman)
requested a review
from a team
as a code owner
July 13, 2026 19:38
Contributor
|
Tip Atmos Pro
No affected stacks workflow was detected for this pull request. 
|
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughRepository automation configuration now restricts additional pull request edit flags, synchronizes eligible dependency-bot pull requests through Mergify, configures Renovate labeling and rebasing, and adjusts workflow matrix allocation hints. ChangesRepository automation configuration
Matrix allocation sizing
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dependency Review✅ No vulnerabilities or license issues found.Scanned FilesNone |
Contributor
|
Important Cloud Posse Engineering Team Review RequiredThis pull request modifies files that require Cloud Posse's review. Please be patient, and a core maintainer will review your changes. To expedite this process, reach out to us on Slack in the |
These denies were added alongside the autonomous pr-maintenance-loop work to keep merge/close/label/reviewer/milestone changes human-owned for that unattended hourly loop, but .claude/settings.json is repo-wide, so it was also blocking closing and labeling PRs in ordinary interactive sessions. Not the intent.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
CodeQL alerts #5314-#5316 flagged len(rows)*len(matrix[axis]) and len(row)+1 as potential overflow in allocation size arithmetic. Both are just capacity hints for append/map-growth, so size each from a single len() instead, matching the existing convention used elsewhere in the codebase for this same CodeQL rule.
Resource Changes Found for
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2752 +/- ##
=======================================
Coverage ? 81.64%
=======================================
Files ? 1648
Lines ? 155530
Branches ? 0
=======================================
Hits ? 126988
Misses ? 21585
Partials ? 6957
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
Andriy Knysh (aknysh)
approved these changes
Jul 14, 2026
Contributor
|
Tip Atmos Pro
No affected stacks workflow was detected for this pull request.
|
|
These changes were released in v1.223.0-rc.11. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
what
no-releaselabel torenovate.json, matching the label Dependabot PRs already get fromdependabot.yml."rebaseWhen": "behind-base-branch"torenovate.jsonso Renovate keeps its own PRs current withmain..github/mergify.ymlthat runsupdateon any open Dependabot/Renovate PR againstmainthat's conflict-free but behind — Dependabot has no native "keep up to date" option, so this fills that gap.why
Triaging the ~18 open Dependabot/Renovate PRs turned up two systemic problems instead of one-off bad PRs:
PR Semver Labelscheck because it carried zero semver label. The check-cleanup logic in.github/workflows/codeql.yml'spr-semver-labelsjob only special-casesdependabot[bot], anddependabot.ymlis the only place a default label gets set — Renovate PRs never got one.main's branch protection requires the PR branch to be up to date (strict: true), but neither bot proactively rebases a clean, non-conflicting PR just becausemainmoved, so PRs accumulate asBEHINDuntil someone manually updates them.This is purely CI/automation config — no user-facing behavior change, hence
no-release.references