Fix dependency review workflow for Dependabot PRs by dvasilas · Pull Request #85 · scality/workflows

dvasilas · 2026-03-20T14:49:07Z

Checkout PR head commit: pull_request_target checks out the base branch by default. We need to pass ref to actions/checkout so the review can analyze PR's changes
Allow Dependabot as bot actor: claude-code-action rejects bot-initiated triggers by default; add dependabot[bot] to allowed_bots
Fix plugin marketplace URL: claude-code-action validates that marketplace URLs end with .git
Configure git credentials for private repos* Accept an optional GIT_ACCESS_TOKEN secret so yarn can install private Scality dependencies and the action can clone the private agent-hub plugin marketplace

.github/workflows/claude-code-dependency-review.yml

tcarmet

I haven't check but on the skills make sure it knows that the setup is done via pull_request_target instead of pull_request

.github/workflows/claude-code-dependency-review.yml

tcarmet · 2026-03-20T20:21:11Z

.github/workflows/claude-code-dependency-review.yml

      contents: read
      pull-requests: write
      id-token: write
+      checks: read


Do we need this one?

It gives the agent permission to read the CI status.
Without it the agent reported CI status: Could not be verified due to API permissions. Confirm CI is green before merging.
With it it is CI status: Several checks still in progress at time of review. No failures observed. because the workflow runs early 🤷

Ok now I'm even more confused, because it should be actions: read

But actually, knowing how github works checks is technically a lower level api of actions so it works.

I would recommend just changing to actions: read if that's ok, it should work the same and makes more sense for a human like me.

I tried it, but I got CI status: Unable to query (permissions); verify CI is green before merging
https://github.com/scality/scuba/pull/407#pullrequestreview-3997059964

So I will revert it for now.
(we could maybe instruct the agent which API to use? 🤔 )

Well now it says CI status: Could not be verified due to API permissions. Recommend confirming CI is green before merging. even after I reverted. Not sure what happened.

It could be that the agent tries to check different things in different runs. I added both permissions.

dvasilas · 2026-03-23T08:35:22Z

I haven't check but on the skills make sure it knows that the setup is done via pull_request_target instead of pull_request

@tcarmet what do you have in mind that the skill must be aware of?

The skill reads the codebase in the PR branch (I think) because the workflow checks out github.event.pull_request.head.sha

tcarmet · 2026-03-23T15:59:35Z

I haven't check but on the skills make sure it knows that the setup is done via pull_request_target instead of pull_request

@tcarmet what do you have in mind that the skill must be aware of?

The skill reads the codebase in the PR branch (I think) because the workflow checks out github.event.pull_request.head.sha

@dvasilas ignore my comment, I think at some point I saw a comment of Nico saying to create a skill to ease the setup of this actions in a repo (so a skill to setup a skill 😂) so I thought it existed, but it doesn't so ignore me :D

tcarmet · 2026-03-23T16:04:45Z

.github/workflows/claude-code-dependency-review.yml

        description: GCP region for Vertex AI
+      ACTIONS_APP_PRIVATE_KEY:
+        required: false
+        description: Private key for the GitHub App used to access private repositories


In my example I setted up as a vars you said it worked so great, but double check if it's best to send it as a input

Suggested change

description: Private key for the GitHub App used to access private repositories

description: Private key for the GitHub App used to access private repositories

inputs:

ACTIONS_APP_ID:

required: false

description: <add description>

If thats the case then change the vars.ACTIONS_APP_ID to inputs.ACTIONS_APP_ID

dvasilas · 2026-03-24T07:44:36Z

I haven't check but on the skills make sure it knows that the setup is done via pull_request_target instead of pull_request

@tcarmet what do you have in mind that the skill must be aware of?
The skill reads the codebase in the PR branch (I think) because the workflow checks out github.event.pull_request.head.sha

@dvasilas ignore my comment, I think at some point I saw a comment of Nico saying to create a skill to ease the setup of this actions in a repo (so a skill to setup a skill 😂) so I thought it existed, but it doesn't so ignore me :D

Oh I see. It doens't exist yet, but I plan to build one.

.github/workflows/claude-code-dependency-review.yml

claude · 2026-03-24T08:11:34Z

.github/workflows/claude-code-dependency-review.yml

    steps:
      - uses: actions/checkout@v6
        with:
+          ref: ${{ github.event.pull_request.head.sha }}


Security note: This workflow is called via workflow_call, so the trigger depends on the caller. If the caller uses pull_request_target, checking out github.event.pull_request.head.sha means untrusted PR code is checked out in a context with write permissions (pull-requests: write).

The risk is mitigated here because:
- yarn install uses --ignore-scripts
- No run: steps execute code from the checked-out repo
- claude-code-action reads but doesn't execute repo files

Consider adding a comment in the workflow noting this security trade-off, so future contributors don't add run: steps that source repo files after checkout.

— Claude Code

claude · 2026-03-24T08:11:41Z

LGTM — solid set of fixes for Dependabot support. One minor note:

- Security trade-off with head SHA checkout (line 40): checking out the PR head in a workflow that may run via pull_request_target means untrusted code is present with write permissions. Currently mitigated by --ignore-scripts and no repo-code execution in run: steps, but worth a comment in the YAML for future maintainers.

Review by Claude Code

claude · 2026-03-24T08:28:59Z

LGTM

The changes are well-structured:
- Checking out PR head via SHA (not ref) is the safe approach for pull_request_target callers
- --ignore-scripts on yarn install is a good security hardening
- GitHub App token generation for private repos follows the standard pattern
- allowed_bots and .git URL fix are correct
- New inputs/secrets are all optional, so no downstream breakage

Review by Claude Code

claude · 2026-03-24T08:37:27Z

LGTM

Review by Claude Code

Add optional ACTIONS_APP_ID input and ACTIONS_APP_PRIVATE_KEY secret to generate a GitHub App token for accessing private org repositories during dependency installation.

Add checks:read and actions:read permissions required for CI status verification.

Set up Node.js explicitly before yarn install with a configurable version (default 22). Add --ignore-scripts to yarn install to prevent execution of arbitrary postinstall scripts from dependency bumps.

claude · 2026-03-31T07:36:12Z

.github/workflows/claude-code-dependency-review.yml

      pull-requests: write
      id-token: write
+      checks: read
+      actions: read


The added checks: read and actions: read permissions aren't used by any of the new steps in this PR (token generation, git config, Node.js setup). If claude-code-action requires them, consider adding a YAML comment explaining why — otherwise remove them to keep least-privilege.

— Claude Code

claude · 2026-03-31T07:36:19Z

Solid set of fixes. One minor item:

checks: read and actions: read permissions added without clear justification from the new steps
- If claude-code-action needs them, add a comment explaining why; otherwise remove to maintain least-privilege

Everything else looks good — head SHA checkout for pull_request_target, --ignore-scripts on yarn, GitHub App token generation, allowed_bots, and the .git suffix fix are all correct.

Review by Claude Code

claude bot reviewed Mar 20, 2026

View reviewed changes

.github/workflows/claude-code-dependency-review.yml Outdated Show resolved Hide resolved

dvasilas marked this pull request as ready for review March 20, 2026 14:51

dvasilas requested a review from a team as a code owner March 20, 2026 14:51

claude bot reviewed Mar 20, 2026

View reviewed changes

.github/workflows/claude-code-dependency-review.yml Show resolved Hide resolved

claude bot reviewed Mar 20, 2026

View reviewed changes

.github/workflows/claude-code-dependency-review.yml Outdated Show resolved Hide resolved

tcarmet reviewed Mar 20, 2026

View reviewed changes

dvasilas force-pushed the fix/dependency-review-dependabot branch from 134c5a3 to c76c385 Compare March 23, 2026 08:10

dvasilas requested a review from tcarmet March 23, 2026 08:35

tcarmet reviewed Mar 23, 2026

View reviewed changes

tcarmet approved these changes Mar 23, 2026

View reviewed changes

claude bot reviewed Mar 24, 2026

View reviewed changes

.github/workflows/claude-code-dependency-review.yml Show resolved Hide resolved

claude bot reviewed Mar 24, 2026

View reviewed changes

scality deleted a comment from claude bot Mar 31, 2026

dvasilas added 5 commits March 31, 2026 10:19

fix: allow Dependabot as bot actor in dependency review

92d0612

fix: add .git suffix to marketplace URL

b937114

fix: checkout PR head commit

f2c2953

feat: support private repository dependencies via GitHub App

39c28ea

Add optional ACTIONS_APP_ID input and ACTIONS_APP_PRIVATE_KEY secret to generate a GitHub App token for accessing private org repositories during dependency installation.

feat: Add permissions for CI status verification

65ddf5a

Add checks:read and actions:read permissions required for CI status verification.

fix: add Node.js setup and harden yarn install

9561dbf

Set up Node.js explicitly before yarn install with a configurable version (default 22). Add --ignore-scripts to yarn install to prevent execution of arbitrary postinstall scripts from dependency bumps.

dvasilas force-pushed the fix/dependency-review-dependabot branch from 6c138a0 to 9561dbf Compare March 31, 2026 07:34

claude bot reviewed Mar 31, 2026

View reviewed changes

dvasilas merged commit 1980d17 into main Mar 31, 2026
9 checks passed

dvasilas deleted the fix/dependency-review-dependabot branch March 31, 2026 07:44

Conversation

dvasilas commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tcarmet left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

tcarmet Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

dvasilas Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

tcarmet Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dvasilas Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dvasilas Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dvasilas commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tcarmet commented Mar 23, 2026

Uh oh!

tcarmet Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

dvasilas Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

dvasilas commented Mar 24, 2026

Uh oh!

Uh oh!

claude bot Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

claude bot commented Mar 24, 2026

Uh oh!

claude bot commented Mar 24, 2026

Uh oh!

claude bot commented Mar 24, 2026

Uh oh!

claude bot Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

claude bot commented Mar 31, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dvasilas commented Mar 20, 2026 •

edited

Loading

tcarmet Mar 23, 2026 •

edited

Loading

dvasilas Mar 24, 2026 •

edited

Loading

dvasilas Mar 24, 2026 •

edited

Loading

dvasilas commented Mar 23, 2026 •

edited

Loading