Skip to content

[Improve] Show Dependabot triage completion status#780

Merged
mrubens merged 2 commits into
developfrom
feature/dependabot-triage-completion-3t29kdzbkn2gu
Jul 25, 2026
Merged

[Improve] Show Dependabot triage completion status#780
mrubens merged 2 commits into
developfrom
feature/dependabot-triage-completion-3t29kdzbkn2gu

Conversation

@roomote-roomote

@roomote-roomote roomote-roomote Bot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

Opened on behalf of Matt Rubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

What changed

  • Dependabot triage now scans and reports every active GitHub repository, including repositories that do not have an execution environment.
  • When there are no active GitHub repositories, triage now skips without posting an empty status message.
  • Each Slack scan reports the total and per-repository open-alert counts, related open dependency pull requests, and the selected remediation outcome.
  • Follow-up tasks now target cohesive alert bundles and must re-check that the targeted actionable alerts are cleared before delivery.

Why this change was made

The previous workflow favored small, quiet triage batches, which could leave multiple related alerts unresolved without showing their count or whether work was already in flight. The automation now makes the outstanding work and its completion path visible.

Impact

Dependabot triage remains read-only and only creates remediation work for repositories with configured environments. Teams gain a complete alert inventory, duplicate-work protection for existing pull requests, and completion-oriented remediation tasks without empty status updates when no repositories are configured.

@roomote-roomote

roomote-roomote Bot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor Author

No code issues found. See task

  • packages/sdk/src/server/automations/dependabot-triage.ts:92 When GitHub is installed but there are no active GitHub repositories, the job now queues a scan with an empty scope. That scan cannot inspect anything yet is instructed to post a status update, causing an empty “0 alerts” message on every scheduled run. Skip this case explicitly while retaining scans for repositories without environments.

Reviewed f0fe328

@roomote-roomote

roomote-roomote Bot commented Jul 25, 2026

Copy link
Copy Markdown
Contributor Author

Fixed in f0fe328a. Dependabot triage now skips before coverage lookup or scan creation when GitHub is installed but no active GitHub repositories exist; active repositories without environments remain in scan scope and are still reported.

@mrubens
mrubens marked this pull request as ready for review July 25, 2026 13:44
@mrubens
mrubens merged commit 2d58e87 into develop Jul 25, 2026
16 checks passed
@mrubens
mrubens deleted the feature/dependabot-triage-completion-3t29kdzbkn2gu branch July 25, 2026 13:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant