ci: Auto-regenerate packaging files on Dependabot PRs - #1763
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds a GitHub Actions workflow to automatically regenerate Rust/Debian packaging artifacts (Cargo.lock normalization for Noble, XS-Vendored-Sources-Rust, and debian/copyright) on Dependabot dependabot/cargo/* pull requests, then push the regenerated files back to the PR branch so the PR becomes merge-ready without manual steps.
Changes:
- Add a
pull_request_targetworkflow triggered byCargo.lockchanges on Dependabotdependabot/cargo/*branches. - Install required Debian/Rust tooling in an
ubuntu:noblecontainer, regenerate vendored metadata and packaging files, then commit/push updates to the PR branch. - Implement concurrency controls to avoid overlapping runs per PR branch.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
adombeck
force-pushed
the
1759-automate-rust-packaging-file-u
branch
4 times, most recently
from
August 12, 2026 10:41
7ed70dc to
5525c96
Compare
adombeck
force-pushed
the
1759-automate-rust-packaging-file-u
branch
2 times, most recently
from
August 18, 2026 12:26
5525c96 to
2c1609c
Compare
adombeck
force-pushed
the
1759-automate-rust-packaging-file-u
branch
from
August 31, 2026 21:41
2c1609c to
17d2982
Compare
adombeck
changed the title
adombeck
marked this pull request as ready for review
August 31, 2026 21:46
adombeck
requested review from
OrazioLucioTerranova,
denisonbarbosa and
nooreldeenmansour
August 31, 2026 21:46
nooreldeenmansour
approved these changes
Sep 1, 2026
nooreldeenmansour
left a comment
nooreldeenmansour
left a comment
Member
There was a problem hiding this comment.
LGTM!
left few comments to consider, nothing blocking, approving in advance
Dependabot updates to the root Cargo and Go manifests can leave these files stale: - Cargo.lock - debian/control's XS-Vendored-Sources-Rust field - debian/copyright for the vendor/ and vendor_rust/ trees Regenerate the files and push them to the PR branch. Generate Cargo.lock and XS-Vendored-Sources-Rust in Ubuntu Noble, which matches the package build and its pinned Cargo. Noble's default Cargo cannot parse Cargo.toml, so put the pinned Cargo bin directory first in PATH. Generate debian/copyright in ubuntu:devel, which provides python3-anytree and matches the licenserecon check. Run generation with read-only permissions because Cargo, cargo-vendor-filterer, Go, and the copyright script may run dependency code. Let the separate write-scoped job apply the artifact and push it without running PR code. Fixes #1759 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
adombeck
force-pushed
the
1759-automate-rust-packaging-file-u
branch
from
September 2, 2026 14:59
17d2982 to
ef4323c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot updates to the root Cargo and Go manifests can leave these files stale:
Cargo.lockXS-Vendored-Sources-Rustfield indebian/controldebian/copyrightfor thevendor/andvendor_rust/treesUpdating these on the Dependabot PRs was a recurring manual chore.
Add a workflow that regenerates these files and pushes them to the PR branch.
Fixes #1759
UDENG-11145