From 6f85c2665c00e2925063f53ea713d125234a5403 Mon Sep 17 00:00:00 2001 From: Richard Levasseur Date: Thu, 22 Oct 2026 00:05:35 -0700 Subject: [PATCH] agents: add composite action dependabot, secret PR, and merge queue rules Composite actions under .github/actions/ can be missed by Dependabot and secret-gated workflow steps do not run on fork PRs. Also, gh pr merge rejects --delete-branch when a merge queue is enabled. Update workflow and merge guidance so agents keep composite actions updated, test secret-gated changes from upstream branches, and omit --delete-branch when merging. --- .agents/rules/github_actions_workflows.md | 15 +++++++++++++-- .agents/skills/merge-pr/SKILL.md | 2 ++ .../skills/review-code/review-workflows-prompt.md | 5 ++++- 3 files changed, 19 insertions(+), 3 deletions(-) diff --git a/.agents/rules/github_actions_workflows.md b/.agents/rules/github_actions_workflows.md index dfec2b092a..f4c2892ac8 100644 --- a/.agents/rules/github_actions_workflows.md +++ b/.agents/rules/github_actions_workflows.md @@ -1,12 +1,23 @@ --- name: github-actions-workflows trigger: glob -globs: ".github/workflows/**,.github/actions/**" +globs: ".github/workflows/**,.github/actions/**,.github/dependabot.yml" --- # GitHub Actions Workflows Rule -* Use the latest version of referenced actions in `.github/workflows/`. +* Use the latest version of referenced actions in `.github/workflows/` and + `.github/actions/` (ensuring actions target supported Node.js runtimes such as + `node24` rather than deprecated `node20`). +* **Dependabot Coverage for Composite Actions**: When adding a composite action + directory under `.github/actions/`, add `"/.github/actions/"` to + the `github-actions` `directories` list in `.github/dependabot.yml` (since + `directory: "/"` only scans `.github/workflows/`). +* **Verifying Secret-Gated Workflow Steps**: GitHub Actions does not expose + repository secrets (e.g. `secrets.BUILDBUDDY_CAS_ONLY_KEY`) to `pull_request` + runs from forks (`origin`). To test secret-gated workflow or composite action + steps in CI, push the branch to `upstream` and open the PR from + `bazel-contrib:`. * **Use Local Composite Actions (`./.github/actions/setup-bazel`)**: Always use local composite action wrappers (such as `uses: ./.github/actions/setup-bazel`) instead of invoking upstream actions diff --git a/.agents/skills/merge-pr/SKILL.md b/.agents/skills/merge-pr/SKILL.md index f05a760d31..f410692a2b 100644 --- a/.agents/skills/merge-pr/SKILL.md +++ b/.agents/skills/merge-pr/SKILL.md @@ -15,6 +15,8 @@ this PR", or monitor its merge): "merge immediately" once CI passes and only `REVIEW_REQUIRED` blocks). Never pass `--admin` while CI is pending or failing unless told to bypass CI. + - **No `--delete-branch` (`-d`)**: Never pass `-d` or `--delete-branch` to + `gh pr merge`; it fails when a merge queue is enabled on the repository. 2. **Invoke a Background Shepherd**: Launch a background subagent with the role `Merge PR Shepherd` to continuously watch the PR until it merges. 3. **Leverage Existing CI Skills**: diff --git a/.agents/skills/review-code/review-workflows-prompt.md b/.agents/skills/review-code/review-workflows-prompt.md index 4543704936..c0ef0d0520 100644 --- a/.agents/skills/review-code/review-workflows-prompt.md +++ b/.agents/skills/review-code/review-workflows-prompt.md @@ -8,7 +8,10 @@ project's workflow rules and conventions: 2. Verify executable permissions: any script invoked directly as a workflow step (e.g. `.github/workflows/*.py`, `*.sh`) must have `chmod +x` (filemode `100755`) and an appropriate shebang (e.g. `#!/usr/bin/env python3`). -3. Verify action versions: ensure workflow steps use the latest action versions. +3. Verify action versions and Dependabot coverage: ensure steps in + `.github/workflows/**` and `.github/actions/**` use the latest action + versions, and verify every `.github/actions/` directory is listed under + `github-actions` `directories` in `.github/dependabot.yml`. 4. Verify fallback jobs: ensure `suppress-no-jobs-ran-error` / `noop` fallback jobs exist in conditional workflows. 5. Check event payload handling: for steps that are a single Python script,