Copilot commented on code in PR #855: URL: https://github.com/apache/solr-operator/pull/855#discussion_r4358166209
########## .github/dependabot.yml: ########## @@ -0,0 +1,103 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Dependabot configuration for the Solr Operator. +# +# Goals: keep the number of dependency PRs low and make each one mergeable +# with little human effort. +# - Everything runs on a monthly cadence. +# - Updates are grouped, so one PR covers many bumps. +# - A cooldown keeps brand-new releases out until they have had a week to +# settle (and to be patched, if needed). +# +# The companion workflow .github/workflows/dependabot-licenses.yaml regenerates +# dependency_licenses.csv on Dependabot PRs so that "make check-licenses" passes. +# +# Reference: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference + +version: 2 +updates: + + # GitHub Actions used in .github/workflows/* + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "monthly" + cooldown: + default-days: 7 Review Comment: `cooldown` is not a Dependabot config key in the options reference up to 2025; if unsupported in your GitHub environment, this will cause the config to be rejected (or the key ignored), meaning the intended 7-day delay won’t apply. Please verify that `cooldown/default-days` is recognized for Dependabot on this repo; if not, drop it and consider alternative approaches (e.g., relying on monthly cadence alone, or using `ignore` rules/update-types where applicable) to achieve similar noise reduction. ########## .github/dependabot.yml: ########## @@ -0,0 +1,103 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Dependabot configuration for the Solr Operator. +# +# Goals: keep the number of dependency PRs low and make each one mergeable +# with little human effort. +# - Everything runs on a monthly cadence. +# - Updates are grouped, so one PR covers many bumps. +# - A cooldown keeps brand-new releases out until they have had a week to +# settle (and to be patched, if needed). +# +# The companion workflow .github/workflows/dependabot-licenses.yaml regenerates +# dependency_licenses.csv on Dependabot PRs so that "make check-licenses" passes. +# +# Reference: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference + +version: 2 +updates: + + # GitHub Actions used in .github/workflows/* + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "monthly" + cooldown: + default-days: 7 + labels: + - "dependencies" + - "github-actions" + commit-message: + prefix: "ci" + groups: + github-actions: + patterns: + - "*" + + # Go modules (go.mod / go.sum) + # + # Only direct dependencies are updated by Dependabot version updates (the + # default), which keeps the indirect tree under control of "go mod tidy". + # Security updates still cover indirect dependencies. + - package-ecosystem: "gomod" + directory: "/" + schedule: + interval: "monthly" + cooldown: + default-days: 7 Review Comment: `cooldown` is not a Dependabot config key in the options reference up to 2025; if unsupported in your GitHub environment, this will cause the config to be rejected (or the key ignored), meaning the intended 7-day delay won’t apply. Please verify that `cooldown/default-days` is recognized for Dependabot on this repo; if not, drop it and consider alternative approaches (e.g., relying on monthly cadence alone, or using `ignore` rules/update-types where applicable) to achieve similar noise reduction. ########## .github/workflows/dependabot-licenses.yaml: ########## @@ -0,0 +1,92 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Dependabot cannot run "make fetch-licenses-list", so every Go dependency bump +# it opens fails "make check-licenses" until a human regenerates +# dependency_licenses.csv. This workflow does that step for Dependabot PRs: +# +# 1. Regenerate dependency_licenses.csv (and tidy go.mod/go.sum). +# 2. If anything changed, commit it to the PR branch. +# 3. Re-dispatch the regular PR checks on the new commit. A push made with +# GITHUB_TOKEN never starts pull_request workflows on its own (this is +# GitHub's loop protection), but workflow_dispatch events always do, and +# their check runs attach to the PR's new head commit. +# +# Dependabot branches live in this repository and only Dependabot (or a +# committer) can push to them, so running "make" on the PR contents is no more +# dangerous than the regular PR checks. + +name: Dependabot license list + +on: + pull_request: + branches: + - 'main' + - 'release-*' + paths: + - 'go.mod' + - 'go.sum' + +jobs: + update-license-list: + name: Regenerate dependency_licenses.csv + if: github.actor == 'dependabot[bot]' && github.repository == 'apache/solr-operator' + runs-on: ubuntu-latest + # Dependabot-triggered workflows get a read-only GITHUB_TOKEN unless the + # permissions are raised explicitly. + permissions: + contents: write + actions: write + + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.ref }} Review Comment: Checking out and pushing by mutable branch ref can race if the PR branch updates while this job is running (e.g., Dependabot rebases), causing non-fast-forward push failures or committing against an outdated head. Prefer checking out `${{ github.event.pull_request.head.sha }}` for a stable base, and before pushing, fetch/rebase onto the latest branch head (or use a safe push strategy like `--force-with-lease`) so the workflow remains reliable under concurrent updates. ########## .github/workflows/dependabot-licenses.yaml: ########## @@ -0,0 +1,92 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Dependabot cannot run "make fetch-licenses-list", so every Go dependency bump +# it opens fails "make check-licenses" until a human regenerates +# dependency_licenses.csv. This workflow does that step for Dependabot PRs: +# +# 1. Regenerate dependency_licenses.csv (and tidy go.mod/go.sum). +# 2. If anything changed, commit it to the PR branch. +# 3. Re-dispatch the regular PR checks on the new commit. A push made with +# GITHUB_TOKEN never starts pull_request workflows on its own (this is +# GitHub's loop protection), but workflow_dispatch events always do, and +# their check runs attach to the PR's new head commit. +# +# Dependabot branches live in this repository and only Dependabot (or a +# committer) can push to them, so running "make" on the PR contents is no more +# dangerous than the regular PR checks. + +name: Dependabot license list + +on: + pull_request: + branches: + - 'main' + - 'release-*' + paths: + - 'go.mod' + - 'go.sum' + +jobs: + update-license-list: + name: Regenerate dependency_licenses.csv + if: github.actor == 'dependabot[bot]' && github.repository == 'apache/solr-operator' + runs-on: ubuntu-latest + # Dependabot-triggered workflows get a read-only GITHUB_TOKEN unless the + # permissions are raised explicitly. + permissions: + contents: write + actions: write + + steps: + - uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.ref }} + + - name: Setup go + uses: actions/setup-go@v5 + with: + go-version-file: go.mod + + - name: Regenerate the dependency license list + run: make fetch-licenses-list + + - name: Detect changes + id: changes + run: | + if git diff --quiet -- dependency_licenses.csv go.mod go.sum; then + echo "changed=false" >> "$GITHUB_OUTPUT" + else + echo "changed=true" >> "$GITHUB_OUTPUT" + git --no-pager diff -- dependency_licenses.csv go.mod go.sum + fi + + - name: Commit and push + if: steps.changes.outputs.changed == 'true' + run: | + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add dependency_licenses.csv go.mod go.sum + git commit -m "Regenerate dependency_licenses.csv for Dependabot update" + git push origin "HEAD:${{ github.event.pull_request.head.ref }}" Review Comment: Checking out and pushing by mutable branch ref can race if the PR branch updates while this job is running (e.g., Dependabot rebases), causing non-fast-forward push failures or committing against an outdated head. Prefer checking out `${{ github.event.pull_request.head.sha }}` for a stable base, and before pushing, fetch/rebase onto the latest branch head (or use a safe push strategy like `--force-with-lease`) so the workflow remains reliable under concurrent updates. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
