Exempt Renovate and Dependabot pull requests from the template check - #194
Conversation
Both bots generate their pull request body themselves, a dependency table plus release notes, and cannot be taught the repository template, so every dependency update failed the pr-template check and needed a manual body. The exemption is a step-level condition on the author login rather than an `on` filter or a job-level `if`. A workflow that never runs leaves a required status check pending, and a job skipped by a job-level condition reports as skipped; keeping one step that runs makes the job report a plain green check.
|
Warning Review limit reached
Next review available in: 6 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
docs
Claudia-Anthropica
left a comment
Claudia-Anthropica
left a comment
There was a problem hiding this comment.
@MarkusPaulsen The exact-login exemption skips only the template-validation steps for Renovate and Dependabot while preserving full validation for every other pull request. The directly relevant actionlint and pr-template checks passed at this head, as did the build; no concrete defect was found.
|
The pull request template now bounds each section: 500 characters for Summary, 1000 for This description was written before those limits and exceeds 1 of them, so I have 1. Problem, as it read before (1187 characters, limit 1000)The Renovate and Dependabot write their own body. Renovate produces a dependency This is a CI defect rather than an enforcement defect: no Ares behaviour, policy |
2 participants
Summary
Renovate and Dependabot pull requests are exempted from the
pr-templatecheck.Their bodies are generated by the tool and can never match the repository
template, so every dependency update arrived with a red required check.
Linked issues
None.
1. Problem
The
pr-templatejob checks every pull request body against.github/PULL_REQUEST_TEMPLATE.md: every##heading present, no section empty, no unfilledstub left behind. It is a required status check, so it carries no
pathsfilter.Renovate and Dependabot write their own body, a dependency table with release notes in one
case and a changelog with a commit list in the other. Neither can be made to emit the Ares
template: Dependabot has no body-template setting, and Renovate's
prBodyTemplatecomposesfixed blocks that cannot express the numbered sections, the coverage table or the checklists.
So roughly thirty bot pull requests fail a check nobody can fix by editing the body, and a
maintainer either rewrites every bot body by hand or merges past a red check.
The fault is in plugging Ares into CI rather than in Ares: no policy, generated test or
enforcement is involved, so it neither let forbidden code through nor failed a submission.
2. Improvement from the user's perspective
No Improvement.
3. Improvement from the maintainer's perspective
Dependency update pull requests become mergeable without hand-editing their
body, so the required check keeps its meaning: a red
pr-templateagain marks ahuman contribution with a malformed body, rather than being routine noise a
maintainer learns to ignore.
The exemption is implemented as a step-level condition rather than an
onfilter or a job-level
if, which preserves the property the workflow alreadydocuments. A workflow that is filtered away never reports and leaves a required
check pending forever; a job skipped by a job-level condition does satisfy a
required check, but reports as skipped. Keeping one step that runs makes
pr-templatereport a plain green check for bot pull requests.4. Testing manual
Prerequisites
ci/exempt-dependency-bots-from-pr-templatechecked out.actionlintlocally, or simply theactionlintworkflow run of this pullrequest.
Steps
Not reproducible from an exercise. This changes a GitHub Actions workflow only,
so it is verified from workflow runs rather than from an Ares exercise.
Before the steps, one property of
pull_requestdecides what is observable when.A
pull_requestrun uses the workflow file from the head branch merged into thebase, so this pull request already runs the new version of the job, while every
other open pull request, including the bot ones, still runs the version on
main. The exempted path therefore cannot be observed anywhere until this ismerged, and steps 4 and 5 are explicitly post-merge.
Steps 1 to 3 are the pre-merge review.
actionlintcheck of this pull request and confirm it is green,which covers the new job-level
envblock and the four step conditions.pr-templatecheck of this pull request, expand the job, and readthe step list. The author is a human, so this is the non-exempt path.
request to delete one
##heading, wait for theeditedre-run, thenrestore the heading and confirm the check returns to green.
it by editing its title, or simply wait for the next one. Open its
pr-templatecheck and expand the job.pr-templatecheck of the next human pull request andconfirm the full validation still runs there.
Expected result
actionlintconcludes success with no findings.Report the exemption for automated dependency pull requestsis marked as skipped, while the checkout, the JDKsetup and
java .github/scripts/CheckPullRequestTemplate.javaall execute.This is what shows the condition is wired up and evaluates to false for a
human author.
success once the heading is restored. This proves the exemption did not
weaken the check for human authors.
Automated dependency pull request, the template check does not apply.withthe checkout, the JDK setup and the checker step marked as skipped.
Negative case (what must still be rejected)
A human pull request with a malformed body must still fail. The condition keys
on
github.event.pull_request.user.loginmatching exactlyrenovate[bot]ordependabot[bot], both of which are GitHub App accounts whose login cannot bechosen by an outside contributor, so it cannot be claimed by a human author or
by a fork. The login is only compared inside an expression and never reaches the
shell, so the existing rule that the untrusted body is passed through the
environment and read with
System.getenvis untouched.Modes exercised
No mode-specific behaviour changed.
5. Test case coverage regarding this PR
No production Java code changed.
Breaking changes and migration
None.
Checklist
docs/,README.adoc, Javadoc) was updated where the change is user-facing.Review progress