Repository navigation
Digest: report Dependabot security updates off, and Dependabot PRs that did not merge #228
Description
Part of the "apply every Dependabot update immediately" rollout (Andrew, 2026-10-25). After that change no human approves Dependabot PRs, so the digest is the only place that shows when the automatic path fails.
1. Dependabot security updates: on or off
scripts/dependabot-digest/standards.sh reads repos/{o}/{r}/vulnerability-alerts (dev-env#220). Alerts on does not mean security-update PRs open. STATUS.md (2026-10-21): on 7 NOS repos and vpn-lan-bridge, "Security updates were left off."
- Read
GET repos/{o}/{r}/automated-security-fixes(enabled,paused). - Report on / off / paused / unreadable, with the same strictness as feat(digest): survey Dependabot security alerts in the daily digest #220 (only an exact, known "off" answer counts as off).
- Forks stay exempt (feat(digest): exempt forks from the Dependabot alerts section #221).
- Check that the digest App installation has the permission this endpoint needs; record it in
docs/runbooks/dependabot-digest-credentials.mdif a scope change is necessary.
2. Dependabot PRs that did not merge
The digest buckets open Dependabot PRs by what a human must do. After github-workflows#203, every open Dependabot PR older than a few hours is a failure of the automatic path.
- New top bucket: open Dependabot PR older than N hours (proposal: 6), or carrying the
dependabot-blockedlabel that docs: record the 2026-10-08 work in STATUS #203 adds. Show the reason: red check (own or borrowed from a red default branch, per the Dependency upgrades have no release valve: majors and grouped PRs wait on review that does not scale #120 analysis), gate deadline, auto-merge not enabled on the repo, approval refused (can_approve_pull_request_reviewsoff). - Push an ntfy alert for this bucket, the same way
scripts/site-monitor/does. A daily issue that nobody reads is the failure mode Dependency upgrades have no release valve: majors and grouped PRs wait on review that does not scale #120 describes. - The paste-ready
merge-locklines stay for local use, but they are no longer the main path.
3. Run cadence
The digest runs at 14:00 UTC daily. With daily Dependabot schedules and immediate security PRs, decide whether that is enough, or whether the "not merged" check runs more often (the site-monitor launchd dispatch on MIMOLETTE is an option).
Tests: bash scripts/dependabot-digest/tests/run-tests.sh, with fixtures for each new state.
Activity
twistedmelonman commentedon Oct 25, 2026
Linked to tracker #229, concern D. With the all-checks gate in github-workflows#203, a red
mainblocks every Dependabot PR, security fixes included. The "not merged" bucket must split "red on its own content" from "red because the default branch is red" (the #120amelia-boonecase). The second needs a different owner and a different alert text, because the fix is inmain, not in the PR.Generated by Claude Code
twistedmelonman commentedon Oct 29, 2026
Label contract from dependabot-auto-merge v3 (smartwatermelon/github-workflows#206)
When the gate does not merge a Dependabot PR, it adds
dependabot-blockedand exactly one reason label. A later merge removes them. The digest can read these instead of guessing.dependabot-blocked:red-checkdependabot-blocked:main-redmainfirst (decision D).dependabot-blocked:timeoutdependabot-blocked:no-checksstandards-check.dependabot-blocked:cannot-evaluatedependabot-blocked:merge-failedgh pr mergefailed.A run that stops because the PR head moved adds no label: the run for the new head decides.
Live only after the
v3tag is cut and callers move to it.twistedmelonman commentedon Oct 30, 2026
Parts 1 and 2 merged (2026-10-30, #243)
200 {"enabled": false}counts as off;pausedis a gap; forks are exempt. The real "off" response is not captured: toggling one repo off and on was refused by the auto-mode classifier. So a 404 or any other answer shows as unreadable, never as off. The endpoint needsadministration=read(X-Accepted-GitHub-Permissions, seen 2026-10-30), which the digest App already has.DIGEST_STALE_HOURS), or labeleddependabot-blockedby the gate. Each row has the reason (the gate's label first, else computed) and who acts.main-redrows sort first and is used only when every failure is also red on a readable base branch.NTFY_TOPIC; priority 4 when a red default branch is involved. An empty topic or a failed delivery fails the run after the issue is written.Survey on 2026-10-30 with the per-owner tokens: security updates on in all 38 readable smartwatermelon and nightowlstudiollc repos (26 + 12).
claude-wrapperunread (its App token needs 1Password, blocked by the sandbox).Open
twistedmelonman commentedon Oct 30, 2026
Part 3 decided (Andrew, 2026-10-30): the digest stays daily at 14:00 UTC. No extra dispatch. What remains open here is the first live run on 2026-10-31: check that the security-updates section reads, and whether the ntfy push arrives.