Ignore Dependabot security updates in the failure watcher

[horgh]

GitHub runs Dependabot version updates and Dependabot security updates under one
workflow name, Dependabot Updates, and the watcher counted both. Security
updates routinely fail for reasons no pull request can fix -- the advisory is
against a dependency the project does not declare directly, or no patched
version is reachable -- so the watcher stays red every week on those and trains
everyone to ignore it.

This filters security-update runs out by title, documents why both halves of
" in /. for " are load-bearing, and bounds the gh run list query server-side
with --created instead of fetching all of history and filtering locally.

See the commit message for the full reasoning, including why reading the
directory list out of dependabot.yml was tried and rejected.

This workflow is shared verbatim across MaxMind repos. The change was developed
in maxmind/device-android (maxmind/device-android#71)
and is applied here unmodified; the resulting file is byte-identical in every
repo.

Summary by CodeRabbit

• Bug Fixes
  • Improved detection of failed Dependabot version update runs by more accurately classifying run types.
  • Reduced false positives by ignoring unrelated advisory and end-to-end smoke-test outcomes.
  • Added handling for startup failures and timed-out runs in failure reporting.
  • Refined status/error messaging to clearly separate relevant Dependabot version update failures from successful checks.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 78894132-dac9-4422-ac6c-52a23470ab87

📥 Commits

Reviewing files that changed from the base of the PR and between 57f521d and 8c36bd2.

📒 Files selected for processing (1)

• .github/workflows/dependabot-failure-watcher.yml

---

📝 Walkthrough

Walkthrough

The Dependabot failure watcher documents run-title classification and filters recent runs to report only relevant Dependabot version update failures.

Changes

Dependabot watcher

Layer / File(s)	Summary
Document and implement version update filtering .github/workflows/dependabot-failure-watcher.yml	The workflow documents Dependabot run-title patterns and exclusions, queries recent runs with server-side time filtering, excludes non-relevant run kinds, and reports selected failure conclusions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• maxmind/GeoIP2-python#454: Introduced the Dependabot failure-watcher logic refined by this change.

Poem

A rabbit watched the runs hop by,
And sorted failures from the sky.
Version updates stayed in view,
While smoke tests quietly withdrew.
“Neat filters!” cheered the bunny crew.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: excluding Dependabot security updates from the failure watcher.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch wstorey/stf-1245-dependabot-failure-watcher-emails-go-to-the-correct-person

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Updates the “Dependabot Failure Watcher” workflow to stop treating Dependabot security update workflow-run failures as actionable signal, so the scheduled watcher only flags failed version update runs and remains a meaningful indicator for ecosystem update health.

Changes:

• Filters out Dependabot security-update runs by displayTitle patterns (including a documented, intentionally-specific root match).
• Moves the time-window bounding into gh run list via --created to reduce history fetching and client-side filtering.
• Expands and clarifies inline documentation explaining the different “Dependabot Updates” run types and why exclusions are necessary.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/dependabot-failure-watcher.yml:
- Line 97: Update the gh run list logic in the Dependabot failure watcher around
the --limit 500 option to detect when the result is saturated and avoid treating
the visible page as complete. Either paginate the run listing or split the
--created time range, and ensure older matching failures remain discoverable so
the watcher fails closed when unseen failures may exist.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 830093b6-2a3f-4def-85ff-7ac850e6c45e

📥 Commits

Reviewing files that changed from the base of the PR and between 22de0f3 and 57f521d.

📒 Files selected for processing (1)

• .github/workflows/dependabot-failure-watcher.yml

[coderabbitai]

🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

: "${REPO:?set REPO=owner/name}"
since=$(date -u -d '8 days ago' +%Y-%m-%dT%H:%M:%SZ)
runs=$(gh run list \
  --repo "$REPO" \
  --workflow "Dependabot Updates" \
  --created ">=$since" \
  --limit 501 \
  --json createdAt)

if [ "$(jq 'length' <<<"$runs")" -ge 501 ]; then
  echo "More than 500 matching runs exist; the watcher may truncate results."
  exit 1
fi

Repository: maxmind/GeoIP2-python

Length of output: 199

---

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "== workflow excerpt =="
if [ -f .github/workflows/dependabot-failure-watcher.yml ]; then
  nl -ba .github/workflows/dependabot-failure-watcher.yml | sed -n '70,115p'
else
  echo "Workflow file not found"
fi

echo
echo "== GitHub CLI availability and run_list help snippet =="
if command -v gh >/dev/null 2>&1; then
  gh --version | head -3
  gh run list --help 2>/tmp/gh-help.log | sed -n '/limit/,50p' || true
else
  echo "gh not installed"
fi

echo
echo "== gh run list call sites =="
rg -n --hidden --glob '!node_modules' --glob '!dist' --glob '!build' 'gh run list|--limit 500|Dependabot Updates|run list' .

Repository: maxmind/GeoIP2-python

Length of output: 222

---

🏁 Script executed:

#!/usr/bin/env bin/bash
set -euo pipefail

REPO="${REPO:-maxmind/GeoIP2-python}"

echo "== workflow excerpt =="
if [ -f .github/workflows/dependabot-failure-watcher.yml ]; then
  awk 'NR>=70 && NR<=115 { printf "%7d  %s\n", NR, $0 }' .github/workflows/dependabot-failure-watcher.yml
else
  echo "Workflow file not found"
fi

echo
echo "== gh run list call sites =="
grep -RInE '(^|[^a-zA-Z0-9_])gh run list|--limit 500|Dependabot Updates|run list' .github . 2>/dev/null | head -200 || true

echo
echo "== gh availability/help =="
if command -v gh >/dev/null 2>&1; then
  gh --version | head -3
  gh run list --help | sed -n '/limit/,+30p' || true
else
  echo "gh not installed"
fi

echo
echo "== repository workflow files =="
find .github/workflows -type f -exec sh -c 'echo "--- {}"; grep -nE "gh run list|limit 500|Dependabot Updates|created" "{}" | head -80 || true' \; || true

Repository: maxmind/GeoIP2-python

Length of output: 6142

---

🏁 Script executed:

#!/usr/bin/env bin/bash
set -euo pipefail

echo "== gh run list command/source references =="
(
  command -v gh >/dev/null 2>&1 && gh --version | head -3 || true
  command -v gh >/dev/null 2>&1 && gh run list -L 500 --help | sed -n '/flags/p;/limit/p' || true
  command -v gh >/dev/null 2>&1 && gh api -X GET /users/mona/actions/runs?per_page=501\&include_workflow_runs=true >/tmp/maybe_api.json 2>/tmp/maybe_api.err; cat /tmp/maybe_api.err || true
)

echo
echo "== API documentation snippets from local gh docs if present =="
find "$(gh --config-dir 2>/dev/null || echo /tmp)" -path '*gh_run_list*' -type f 2>/dev/null | head -20 | xargs -r grep -n -i 'limit\|per_page\|runs' || true

Repository: maxmind/GeoIP2-python

Length of output: 579

---

Check for saturation after listing runs.

--limit 500 caps the gh run list result, and with --created newer runs filling that cap, older matching runs are dropped before the failure filter runs. Detect a saturated output page or paginate/split the time range so the watcher fails closed on unseen older failures.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/dependabot-failure-watcher.yml at line 97, Update the gh
run list logic in the Dependabot failure watcher around the --limit 500 option
to detect when the result is saturated and avoid treating the visible page as
complete. Either paginate the run listing or split the --created time range, and
ensure older matching failures remain discoverable so the watcher fails closed
when unseen failures may exist.

Source: MCP tools