chore(ci): add github dependabot skill - #209
Conversation
github-actions
Bot
added
scope(core)
scope(ci)
scope(internals)
scope(cli)
scope(monaco)
scope(themes)
dependencies
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (10)
📝 WalkthroughWalkthroughThis change adds a Dependabot remediation skill, updates dependency versions and a catalog reference, makes theme token builds await platform generation, and synchronizes ChangesDependency maintenance updates
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
ESLint install failed. For unrecoverable errors, disable the tool in CodeRabbit configuration. Comment |
There was a problem hiding this comment.
Pull request overview
This PR adds a new github-dependabot agent skill to standardize how Dependabot alerts are investigated/remediated in the Elements monorepo, and it also updates a set of dependency versions (plus associated NOTICE entries) across several workspaces.
Changes:
- Add
.agents/skills/github-dependabot/SKILL.mddocumenting a Dependabot-alert remediation workflow usinggh api. - Bump/normalize multiple dependencies across workspaces (e.g.,
style-dictionary,@angular/build,svgo,adm-zip,sanitize-html, andesbuildmoved to the pnpm catalog). - Update NOTICE files to reflect the
adm-zipversion/license metadata change.
Reviewed changes
Copilot reviewed 9 out of 10 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| projects/themes/package.json | Bumps style-dictionary major version used by the themes token build pipeline. |
| projects/starters/angular/package.json | Updates Angular build tooling dependency version for the Angular starter. |
| projects/monaco/package.json | Switches esbuild from a pinned version to the workspace catalog: version. |
| projects/internals/tools/package.json | Updates adm-zip and sanitize-html versions in internal tooling dependencies. |
| projects/core/package.json | Bumps svgo patch version used in core tooling/build steps. |
| projects/cli/package.json | Bumps adm-zip used by the CLI package. |
| projects/cli/NOTICE.md | Updates bundled third-party notice entries for the new adm-zip version/metadata. |
| NOTICE.md | Updates the root bundled third-party notice entries for the new adm-zip version/metadata. |
| .agents/skills/github-dependabot/SKILL.md | Adds the new Dependabot remediation skill documentation/workflow. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| "devDependencies": { | ||
| "@angular/build": "22.0.3", | ||
| "@angular/build": "22.1.0", | ||
| "@angular/cli": "22.0.3", | ||
| "@angular/compiler-cli": "22.0.2", | ||
| "@nvidia-elements/lint": "workspace:*", |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/skills/github-dependabot/SKILL.md:
- Around line 23-25: Update the gh api commands in the dependabot skill to use
the dynamic repository path repos/{owner}/{repo} instead of the hard-coded
NVIDIA/elements path, including both command occurrences. Preserve the existing
alert query options and pagination behavior.
In `@projects/themes/package.json`:
- Line 61: Update the buildTokens flow that calls style-dictionary’s
buildAllPlatforms so both build operations are awaited before the function
returns. The issue is in the asynchronous Style Dictionary v5 build path: make
buildTokens wait for the generated CSS assets to finish writing before any later
step, including style-dictionary.minify.js, can read them. Keep the existing
token build sequence intact and only add the required awaiting around the two
buildAllPlatforms calls.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Enterprise
Run ID: b73014f9-25ed-4377-9050-dda3af6ad304
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (9)
.agents/skills/github-dependabot/SKILL.mdNOTICE.mdprojects/cli/NOTICE.mdprojects/cli/package.jsonprojects/core/package.jsonprojects/internals/tools/package.jsonprojects/monaco/package.jsonprojects/starters/angular/package.jsonprojects/themes/package.json
Signed-off-by: Cory Rylan <crylan@nvidia.com>
- Updated adm-zip from v0.5.17 to v0.6.0, changing the copyright email. - Updated svgo from v4.0.1 to v4.0.2. - Updated @angular/build from v22.0.3 to v22.1.0. - Updated style-dictionary from v4.3.0 to v5.4.4. - Added esbuild v0.28.1 to pnpm-lock.yaml. Signed-off-by: Cory Rylan <crylan@nvidia.com>
0d551d3 to
efc3d1d
Compare
|
Note GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer. |
|
🎉 This issue has been resolved in version 2.2.3 🎉 |
Summary by CodeRabbit
Bug Fixes
Updates
Documentation