[dolfim-ibm]

Improve the nightly update of the locked Docling dependencies (.github/workflows/update-deps.yml), after the first run in #4985.

Changes

• Explain the reference data changes. groundtruth_diff.py has a new git range mode: python3 .github/scripts/groundtruth_diff.py BASE HEAD. The job adds its output to the PR. For each changed reference file it shows the kind of change (structure, tables, text, coordinates only, formatting only) with short details, for example picture: 2 → 0. The PR also lists the failing tests of each suite.
• Push new reference data on top of fixes. Before, the job stopped updating the branch once it had commits from other authors. Now, while the PR is open, the job builds on that branch: it upgrades the lock, regenerates the reference data with the fixes, pushes one more commit without a force-push, and posts the summary as a PR comment. When the branch has only commits from the job, the job still rebuilds it from main.
• The job updates the PR body through the REST API, because gh pr edit fails on the classic Projects fields.

Validation

• actionlint passes.
• tests/test_groundtruth_diff.py passes, with a new test for the git range mode.
• I ran the git range mode on the commit of chore: update locked docling dependencies #4985 and checked the output.

[github-actions]

✅ DCO Check Passed

Thanks @dolfim-ibm, all your commits are properly signed off. 🎉

[mergify]

Merge Protections

🟢 Merge protection satisfied — ready to merge.

Show 1 satisfied protection

🟢 Enforce conventional commit

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|docs|style|refactor|perf|test|build|ci|chore|revert)(?:\(.+\))?(!)?:

[github-actions]

AI triage (advisory)

Checked commit 48e16f63db. The analysis read the diff only. It did not run code from this pull request.

The PR adds a git range mode to groundtruth_diff.py and a test for it. It also changes the update-deps.yml workflow so that it builds on commits from other authors, pushes one more commit without a force-push, and posts a summary of reference data changes and failing tests.

CI safety: needs maintainer care before you approve CI.

• .github/scripts/groundtruth_diff.py: changes CI workflows, actions, or CI scripts
• .github/workflows/update-deps.yml: changes CI workflows, actions, or CI scripts
• .github/workflows/update-deps.yml: The lock job now creates a GitHub App token from secrets.CI_PRIVATE_KEY, and then runs git checkout "origin/$PR_BRANCH" and the local ./.github/actions/setup-ubuntu-ci action from that branch, which can contain commits from other authors.
• .github/workflows/update-deps.yml: In update mode, the open-pr job runs git push origin "$PR_BRANCH" with the App token on top of commits from other authors, and git add --all -- uv.lock tests adds everything under tests to that commit.

1 related pull request(s) in the same code

PR	State	Signal	Assessment
#4985	open	referenced as #4985	related: PR 4985 is an automated dependency update that the changed workflow creates. It changes reference data and uv.lock. It does not change the workflow or the script in this PR.

_{The ai:* labels are advisory. They do not approve CI and they do not add tests:full. A new push runs this check again.}

[github-actions]

AI first review (advisory): blocker found

This review covers the full diff at 48e16f63db. It read the code and did not run it.

In update mode the job runs the summary script from the old PR branch, not from main. A branch made before this PR merges has a script without the git range mode, so the summary can say "No reference data changed." when files did change. Check where groundtruth_diff.py comes from in the open-pr job.

_{A maintainer makes the merge decision. This review never approves the pull request.}

[github-actions]

blocker: Update mode runs a stale groundtruth_diff.py and can report no changes by mistake

Trigger: In update mode the open-pr job checks out needs.lock.outputs.base_sha. That commit is the tip of the existing PR branch, not main. The step then runs .github/scripts/groundtruth_diff.py from that checkout.

The PR branch is never rebased on main. The branch of the open PR #4985 was cut before this PR merges. On main, groundtruth_diff.py has only functions. It has no main() and no __main__ block. A script like that prints nothing when you run it.

Wrong result: summary is empty, so line 317 prints No reference data changed. The new commit may change many reference files. The PR comment then gives a false statement, and the reviewer reads it to decide if the data is safe.

The same applies to every other script and local action that the job takes from the branch. Examples are pytest_marker_selection.py and ./.github/actions/setup-ubuntu-ci. They can be old or edited on a fix branch.

Fix: Take the CI scripts from the default branch. For example, run git show origin/main:.github/scripts/groundtruth_diff.py | python3 - HEAD~1 HEAD, or check out main into a second directory and run the script from there. Also, make the step fail when the script exits with an error. Do not fall back to "No reference data changed." for an empty result.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!