fix: only touch dependabot.yml when --dependabot flag is used by Copilot · Pull Request #39909 · github/gh-aw

Copilot · 2026-06-17T22:08:02Z

gh aw compile was rewriting .github/dependabot.yml on every run as a side effect, stripping comments and reordering keys (non-prettier-compliant) via YAML round-trip marshal/unmarshal — even when --dependabot was never passed.

Changes

pkg/cli/compile_pipeline.go: Gate both ReconcileManagedDependabotIgnores call sites (runPostProcessing and runPostProcessingForDirectory) on config.Dependabot, matching the existing guard already in place for GenerateDependabotManifests:
```
// Before
if !config.NoEmit {
    compiler.ReconcileManagedDependabotIgnoresInRepo(gitRoot)
}

// After
if config.Dependabot && !config.NoEmit {
    compiler.ReconcileManagedDependabotIgnoresInRepo(gitRoot)
}
```
pkg/cli/compile_dependabot_test.go: Add integration test TestCompileWithoutDependabotFlagDoesNotTouchDependabotYML verifying that a dependabot.yml with comments is byte-identical after compile without --dependabot.

``
pr-sous-chef: update branch requested in run 27724831557

Generated by 👨‍🍳 PR Sous Chef · ◷

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

This PR aims to ensure gh aw compile does not modify .github/dependabot.yml unless the user explicitly opts in with --dependabot, preventing unintended YAML round-trips that strip comments/reorder keys.

Changes:

Gate ReconcileManagedDependabotIgnoresInRepo(...) behind config.Dependabot && !config.NoEmit in both post-processing paths.
Add an integration test asserting an existing dependabot.yml (including comments) remains byte-identical when compiling without --dependabot.
Includes additional updates to an installer script comment and a compiled workflow lockfile.

Show a summary per file

File	Description
pkg/cli/compile_pipeline.go	Gates Dependabot ignore reconciliation so it only runs when `--dependabot` is requested.
pkg/cli/compile_dependabot_test.go	Adds an integration test to ensure compile without `--dependabot` does not touch `.github/dependabot.yml`.
actions/setup-cli/install.sh	Updates the “kept in sync” note (currently appears incorrect/self-referential).
.github/workflows/daily-formal-spec-verifier.lock.yml	Regenerates part of a compiled workflow lockfile (unrelated to stated PR scope).

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 4/4 changed files
Comments generated: 2

github-actions · 2026-06-17T22:41:37Z

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #39909 does not have the 'implementation' label and has 76 new lines of code in business logic directories (≤100 threshold).

github-actions · 2026-06-17T22:41:37Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

github-actions · 2026-06-17T22:41:40Z

✅ Test Quality Sentinel completed test quality analysis.

github-actions · 2026-06-17T22:41:59Z

✅ PR Code Quality Reviewer completed the code quality review.

github-actions · 2026-06-17T22:46:29Z

🧪 Test Quality Sentinel Report

✅ Test Quality Score: 90/100 — Excellent

Analyzed 1 test(s): 1 design, 0 implementation, 0 guideline violation(s).

📊 Metrics & Test Classification (1 test analyzed)

Metric	Value
New/modified tests analyzed	1
✅ Design tests (behavioral contracts)	1 (100%)
⚠️ Implementation tests (low value)	0 (0%)
Tests with error/edge cases	1 (100%)
Duplicate test clusters	0
Test inflation detected	YES (74 test lines / 2 production lines ≈ 37:1)
🚨 Coding-guideline violations	0

Test	File	Classification	Issues Detected
`TestCompileWithoutDependabotFlagDoesNotTouchDependabotYML`	`pkg/cli/compile_dependabot_test.go:437`	✅ Design	Test inflation (37:1 ratio)

Go: 1 (*_test.go); JavaScript: 0. Other languages detected but not scored.

Verdict

✅ Check passed. 0% implementation tests (threshold: 30%). The new integration test directly enforces the behavioral contract that compile without --dependabot must not touch an existing dependabot.yml. Test inflation is flagged (74 new test lines vs 2 production lines) but is expected for integration tests requiring full environment setup.

🧪 Test quality analysis by Test Quality Sentinel · ◷

github-actions

✅ Test Quality Sentinel: 90/100. Test quality is excellent — 0% of new tests are implementation tests (threshold: 30%).

github-actions

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-06-17T22:49:44Z

 }

+// TestCompileWithoutDependabotFlagDoesNotTouchDependabotYML verifies that compiling
+// without --dependabot does not modify an existing dependabot.yml file.


[/diagnose] The test pins the "no-touch" invariant but has no counterpart confirming the file IS reconciled when Dependabot: true. Without a positive-case test, a future regression that accidentally removes both guards would still pass the suite.

💡 Companion test sketch

func TestCompileWithDependabotFlagReconcilesDependabotYML(t *testing.T) { // ... same setup as existing test ... config := CompileConfig{ WorkflowDir: ".github/workflows", Dependabot: true, // flag ON this time } _, err := CompileWorkflows(context.Background(), config) require.NoError(t, err) after, _ := os.ReadFile(dependabotPath) if string(after) == dependabotContent { t.Error("dependabot.yml should have been reconciled with --dependabot set") } }

Together the two tests make the flag contract self-documenting and prevent regressions in both directions.

github-actions · 2026-06-17T22:49:44Z

+		t.Fatalf("failed to create workflows directory: %v", err)
+	}
+
+	// Change to temp directory


[/tdd] The error from os.Getwd() is silently discarded. If it fails, origDir is "" and defer os.Chdir("") will corrupt the working directory for any test that runs afterwards in the same package.

💡 Safer pattern

origDir, err := os.Getwd() if err != nil { t.Fatalf("failed to get working directory: %v", err) } t.Cleanup(func() { _ = os.Chdir(origDir) }) if err := os.Chdir(tempDir); err != nil { t.Fatalf("failed to chdir to temp dir: %v", err) }

On Go 1.24+ t.Chdir(tempDir) handles setup, restore, and error handling automatically.

github-actions

Core fix is correct — gating ReconcileManagedDependabotIgnoresInRepo on config.Dependabot is the right call and matches the existing guard already in place for GenerateDependabotManifests. Two non-blocking observations left as inline comments.

Findings summary

Test coverage gap (medium)

The new test routes through compileAllFilesInDirectory → runPostProcessingForDirectory (MarkdownFiles: nil). The symmetric fix in runPostProcessing (specific-file compilation path) has no test. A regression there would be invisible to CI.

Duplicate identical guard in `runPostProcessing` (minor)

After the fix, runPostProcessing has two back-to-back if config.Dependabot && !config.NoEmit blocks, each with its own FindGitRoot() call. Pre-fix, the conditions differed; now they're identical and should be merged into one block — consistent with how runPostProcessingForDirectory already handles it.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

patchdiff.githubusercontent.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "patchdiff.githubusercontent.com"

See Network Configuration for more information.

🔎 Code quality review by PR Code Quality Reviewer

github-actions · 2026-06-17T22:50:28Z

+
+	// Compile WITHOUT the Dependabot flag
+	config := CompileConfig{
+		MarkdownFiles:  nil,


Test only covers the runPostProcessingForDirectory path; the runPostProcessing fix is untested.

💡 Details

With MarkdownFiles: nil, CompileWorkflows routes to compileAllFilesInDirectory → runPostProcessingForDirectory, exercising the fix at compile_pipeline.go:579. The symmetric fix at compile_pipeline.go:525 (inside runPostProcessing, taken when MarkdownFiles != nil) has no corresponding test.

If that guard is accidentally reverted or diverged later, CI will not catch it. A second test that sets MarkdownFiles to the compiled .md file would cover this path:

config := CompileConfig{ MarkdownFiles: []string{workflowPath}, Dependabot: false, ... }

github-actions · 2026-06-17T22:50:28Z


 	// Reconcile compiler-managed Dependabot ignore entries for compiler-emitted action refs.
-	if !config.NoEmit {
+	if config.Dependabot && !config.NoEmit {


Two consecutive if config.Dependabot && !config.NoEmit blocks now exist here, each calling FindGitRoot() independently — merge them into one.

💡 Suggested fix

Before this PR, the two blocks had different conditions (config.Dependabot && !config.NoEmit vs !config.NoEmit). After the fix they are identical, but remain as two separate if statements with separate gitutil.FindGitRoot() calls. Merging eliminates the redundant filesystem walk:

if config.Dependabot && !config.NoEmit { if gitRoot, err := gitutil.FindGitRoot(); err == nil { absWorkflowDir := filepath.Join(gitRoot, config.WorkflowDir) if err := generateDependabotManifestsWrapper(compiler, workflowDataList, absWorkflowDir, config.ForceOverwrite, config.Strict); err != nil { if config.Strict { return err } } if err := compiler.ReconcileManagedDependabotIgnoresInRepo(gitRoot); err != nil { if config.Strict { return err } fmt.Fprintln(os.Stderr, console.FormatWarningMessage(...)) } } }

This also makes it structurally consistent with runPostProcessingForDirectory, which already shares gitRoot across both calls.

github-actions · 2026-06-17T23:00:44Z

``
Please resolve the inline review threads (duplicate Dependabot guard and coverage gap) and push an update.

Generated by 👨‍🍳 PR Sous Chef · ◷

pelikhan · 2026-06-17T23:18:02Z

@copilot run pr-finisher skill

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-06-17T23:32:10Z

@copilot run pr-finisher skill

Ran pr-finisher pass and pushed updates in 56b7907. I addressed the in-scope review feedback, validated locally (make fmt, make lint, make test-unit, make test, make recompile), and ran final parallel validation + secret scan.

Initial plan

29bb43e

Copilot AI assigned Copilot and pelikhan Jun 17, 2026

Copilot started work on behalf of pelikhan June 17, 2026 22:08 View session

Copilot AI and others added 2 commits June 17, 2026 22:12

Initial plan: gate dependabot operations on --dependabot flag

4ec0311

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

fix: only touch dependabot.yml when --dependabot flag is used

ae793af

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix comment loss and reordering in dependabot.yml~~ fix: only touch dependabot.yml when --dependabot flag is used Jun 17, 2026

Copilot finished work on behalf of pelikhan June 17, 2026 22:21

Copilot AI requested a review from pelikhan June 17, 2026 22:21

pelikhan marked this pull request as ready for review June 17, 2026 22:26

Copilot AI review requested due to automatic review settings June 17, 2026 22:26

Copilot started reviewing on behalf of pelikhan June 17, 2026 22:26 View session

Copilot AI reviewed Jun 17, 2026

View reviewed changes

Comment thread actions/setup-cli/install.sh Outdated

Comment thread .github/workflows/daily-formal-spec-verifier.lock.yml

github-actions Bot mentioned this pull request Jun 17, 2026

[aw] No-Op Runs #39849

Open

github-actions Bot approved these changes Jun 17, 2026

View reviewed changes

github-actions Bot reviewed Jun 17, 2026

View reviewed changes

github-actions Bot and others added 2 commits June 17, 2026 23:00

Merge branch 'main' into copilot/compile-rewrites-dependabot-yml

68c9039

Merge branch 'main' into copilot/compile-rewrites-dependabot-yml

766b6a5

Copilot started work on behalf of pelikhan June 17, 2026 23:22 View session

test: cover specific-file compile path for dependabot no-touch

56b7907

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Merge branch 'main' into copilot/compile-rewrites-dependabot-yml

f4b0537

pelikhan merged commit 81da2d6 into main Jun 17, 2026
29 checks passed

pelikhan deleted the copilot/compile-rewrites-dependabot-yml branch June 17, 2026 23:37

Copilot stopped work on behalf of pelikhan due to an error June 17, 2026 23:37
The session was cancelled by the user.

Conversation

Copilot AI commented Jun 17, 2026 • edited by github-actions Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 17, 2026

🧪 Test Quality Sentinel Report

Verdict

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Test coverage gap (medium)

Duplicate identical guard in runPostProcessing (minor)

Uh oh!

github-actions Bot Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot Jun 17, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

pelikhan commented Jun 17, 2026

Uh oh!

Copilot AI commented Jun 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jun 17, 2026 •

edited by github-actions Bot

Loading

github-actions Bot commented Jun 17, 2026 •

edited

Loading

github-actions Bot commented Jun 17, 2026 •

edited

Loading

github-actions Bot commented Jun 17, 2026 •

edited

Loading

github-actions Bot commented Jun 17, 2026 •

edited

Loading

Duplicate identical guard in `runPostProcessing` (minor)