From e4d71e0f76c34d4a7c01fc5d52a9955c00de8a76 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kamila=20=C5=9Aroda?= Date: Fri, 21 Aug 2026 11:17:44 +0200 Subject: [PATCH 1/3] ci: auto-regenerate snippets on dependabot PRs Bumping a library named in a samples/*/manifest.yaml `lib:` field changes the `lib_version` embedded in snippets.json, so the drift check in the `validate` job fails on an otherwise-fine dependency PR and blocks auto-merge until someone runs `cd scripts && yarn all` by hand. Add a `refresh-snippets` job that, for dependabot PRs only, re-runs aggregate + extract and pushes the result back to the PR branch. It keys off detected drift rather than matching package names, so there is no list of libraries to keep in sync and the per-scenario `lib:` overrides are covered too. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/extract.yml | 51 +++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) diff --git a/.github/workflows/extract.yml b/.github/workflows/extract.yml index b117c75..db225e4 100644 --- a/.github/workflows/extract.yml +++ b/.github/workflows/extract.yml @@ -48,6 +48,57 @@ jobs: git diff --exit-code snippets.json snippet-manifest.yaml || \ (echo "::error::Extracted artifacts are out of date. Run 'cd scripts && yarn all' and commit the results." && exit 1) + # Dependabot bumps of a library whose version is embedded in snippets.json + # (the `lib:` field of a samples/*/manifest.yaml) leave the extracted artifacts + # stale, so `validate` fails on an otherwise-fine PR. Regenerate and push back + # to the PR branch; the resulting commit re-runs the checks and auto-merge + # proceeds. Detecting drift beats matching package names — no list to keep in + # sync, and it covers the per-scenario `lib:` overrides too. + # + # The PAT is required: GITHUB_TOKEN is read-only on Dependabot events, and a + # push made with it would not re-trigger the required checks. + refresh-snippets: + if: >- + github.event_name == 'pull_request' && + github.event.pull_request.user.login == 'dependabot[bot]' + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + ref: ${{ github.head_ref }} + token: ${{ secrets.GH_SERVICE_ACCOUNT_DEVOPS_2_PAT1 }} + + - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 + with: + node-version: "22" + + - name: Enable Corepack + run: corepack enable + + - name: Install dependencies + working-directory: scripts + run: yarn install --immutable + + - name: Aggregate manifests + working-directory: scripts + run: yarn aggregate + + - name: Extract snippets + working-directory: scripts + run: yarn extract + + - name: Commit regenerated artifacts + run: | + if git diff --quiet snippets.json snippet-manifest.yaml; then + echo "Artifacts already up to date — nothing to push." + exit 0 + fi + git config user.name "github-actions[bot]" + git config user.email "github-actions[bot]@users.noreply.github.com" + git add snippets.json snippet-manifest.yaml + git commit -m "chore: regenerate snippets for dependency bump" + git push + commit: needs: validate if: github.event_name == 'push' From 6ae678fdf394fcb169dd24682345f3f2e1a706a5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kamila=20=C5=9Aroda?= Date: Fri, 21 Aug 2026 12:57:05 +0200 Subject: [PATCH 2/3] ci: re-approve and re-arm auto-merge after pushing snippets --- .github/workflows/extract.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.github/workflows/extract.yml b/.github/workflows/extract.yml index db225e4..613651d 100644 --- a/.github/workflows/extract.yml +++ b/.github/workflows/extract.yml @@ -88,6 +88,7 @@ jobs: run: yarn extract - name: Commit regenerated artifacts + id: commit run: | if git diff --quiet snippets.json snippet-manifest.yaml; then echo "Artifacts already up to date — nothing to push." @@ -98,6 +99,22 @@ jobs: git add snippets.json snippet-manifest.yaml git commit -m "chore: regenerate snippets for dependency bump" git push + echo "pushed=true" >> "$GITHUB_OUTPUT" + + # Pushing here has two side effects that have to be undone. Branch + # protection dismisses stale approvals on a new commit, and the + # dependabot-auto-merge run that commit triggers skips itself because + # `github.actor` is now the service account rather than dependabot[bot]. + # Without this the PR ends up green but unapproved and no longer queued + # to auto-merge. + - name: Re-approve and re-arm auto-merge + if: steps.commit.outputs.pushed == 'true' + run: | + gh pr review --approve "$PR_URL" + gh pr merge --auto --squash "$PR_URL" + env: + PR_URL: ${{ github.event.pull_request.html_url }} + GH_TOKEN: ${{ secrets.GH_SERVICE_ACCOUNT_DEVOPS_2_PAT1 }} commit: needs: validate From 499335dc0744228ea47417b407add37cae82f8c8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kamila=20=C5=9Aroda?= Date: Fri, 21 Aug 2026 13:09:16 +0200 Subject: [PATCH 3/3] ci: scope the push credential to the push step --- .github/workflows/extract.yml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/extract.yml b/.github/workflows/extract.yml index 613651d..23a7621 100644 --- a/.github/workflows/extract.yml +++ b/.github/workflows/extract.yml @@ -63,10 +63,13 @@ jobs: github.event.pull_request.user.login == 'dependabot[bot]' runs-on: ubuntu-latest steps: + # Checked out with the read-only default token and `persist-credentials: + # false`, so no write-scoped credential sits in .git/config while the + # dependency install and extract run. The PAT is handed to the push alone. - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: ref: ${{ github.head_ref }} - token: ${{ secrets.GH_SERVICE_ACCOUNT_DEVOPS_2_PAT1 }} + persist-credentials: false - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 with: @@ -89,6 +92,11 @@ jobs: - name: Commit regenerated artifacts id: commit + env: + # Referenced as shell variables rather than interpolated into the + # script, so a branch name can't inject into the run block. + TOKEN: ${{ secrets.GH_SERVICE_ACCOUNT_DEVOPS_2_PAT1 }} + HEAD_REF: ${{ github.head_ref }} run: | if git diff --quiet snippets.json snippet-manifest.yaml; then echo "Artifacts already up to date — nothing to push." @@ -98,7 +106,8 @@ jobs: git config user.email "github-actions[bot]@users.noreply.github.com" git add snippets.json snippet-manifest.yaml git commit -m "chore: regenerate snippets for dependency bump" - git push + git push "https://x-access-token:${TOKEN}@github.com/${GITHUB_REPOSITORY}.git" \ + "HEAD:refs/heads/${HEAD_REF}" echo "pushed=true" >> "$GITHUB_OUTPUT" # Pushing here has two side effects that have to be undone. Branch