Skip to content

Add workflow that fails when Dependabot updates error #454

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
oschwald merged 1 commit into from
Jul 22, 2026
+43 −0
Merged

Add workflow that fails when Dependabot updates error #454

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 43 additions & 0 deletions .github/workflows/dependabot-failure-watcher.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
name: Dependabot Failure Watcher

# Dependabot version updates run as GitHub Actions workflow runs named
# "Dependabot Updates". This scheduled job looks back over the past week for any
# of those runs that failed and fails itself if it finds one, so a silently-broken
# ecosystem surfaces as a red scheduled run instead of only a red triangle in the
# Dependabot tab that nobody checks.
#
# Runs entirely within this repo (no external service). A failed scheduled run
# emails the person who last edited the cron below. Note: GitHub auto-disables
# scheduled workflows after 60 days of repo inactivity.

on:
schedule:
- cron: "17 14 * * 3" # Wednesdays 14:17 UTC
workflow_dispatch:

permissions:
actions: read

jobs:
check-dependabot-runs:
runs-on: ubuntu-latest
steps:
- name: Fail if any Dependabot update failed in the last 8 days
env:
GH_TOKEN: ${{ github.token }}
REPO: ${{ github.repository }}
run: |
since=$(date -u -d '8 days ago' +%Y-%m-%dT%H:%M:%SZ)
failures=$(gh run list \
--repo "$REPO" \
--workflow "Dependabot Updates" \
Comment on lines +31 to +33

@coderabbitai coderabbitai Bot Jul 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

sed -n '1,120p' .github/workflows/dependabot-failure-watcher.yml

Repository: maxmind/GeoIP2-python

Length of output: 1921

🌐 Web query:

GitHub CLI gh run list disabled workflows --all workflow name filter documentation

💡 Result:

To list workflow runs for a disabled workflow using the GitHub CLI (gh), you must use the -w (or --workflow) flag in combination with the -a (or --all) flag [1][2]. By default, the gh run list command does not fetch runs associated with disabled workflows when filtering by a workflow name [1][2]. To include these, you must explicitly pass the -a flag [1][3][2]. Example usage: gh run list -w "Workflow Name" -a Key points regarding this functionality: - Workflow Identification: You can replace "Workflow Name" with the workflow name, workflow ID, or workflow file name [4]. - Filtering Behavior: If you provide a workflow name to the -w flag without the -a flag, the command will not return runs from disabled workflows [1][2]. - Combined Flags: Passing both -w and -a ensures the CLI explicitly fetches runs for that specific workflow even if it is currently disabled [1][2]. For more information on the flags available, you can run gh help run list in your terminal [1][5].

Citations:

Include disabled workflow runs. gh run list --workflow skips disabled workflows unless --all is added, so a disabled Dependabot Updates workflow could make this watcher report a false clean run.

Proposed fix 
           failures=$(gh run list \
             --repo "$REPO" \
+            --all \
             --workflow "Dependabot Updates" \
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
failures=$(gh run list \
--repo "$REPO" \
--workflow "Dependabot Updates" \
failures=$(gh run list \
--repo "$REPO" \
--all \
--workflow "Dependabot Updates" \
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/dependabot-failure-watcher.yml around lines 31 - 33,
Update the gh run list invocation in the failure watcher to include the --all
option alongside the existing --workflow "Dependabot Updates" filter, ensuring
runs from disabled workflows are considered.

--limit 100 \
--json conclusion,createdAt,displayTitle,url \
--jq "[.[] | select((.conclusion == \"failure\" or .conclusion == \"startup_failure\" or .conclusion == \"timed_out\") and .createdAt >= \"$since\")]")
Comment on lines +35 to +36

@coderabbitai coderabbitai Bot Jul 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

GitHub CLI gh run list updatedAt createdAt semantics workflow run completion timestamp

💡 Result:

The GitHub CLI gh run list command provides several timestamps through its --json flag, but it does not include a dedicated field for "completion time." The semantics and behavior of the available timestamps are as follows: Available Timestamps When using gh run list --json, the following fields are available: - createdAt: The time the workflow run was created [1][2][3]. - startedAt: The time the workflow run actually began execution [1][2][3]. - updatedAt: The last time the workflow run was updated [1][2][3]. Semantics and Completion Timestamp The GitHub API and CLI do not provide a specific field for when a workflow run finished [4]. Because of this, gh does not expose a formal "completion time" [4]. In the default interactive table view, gh run list often displays an "elapsed" time to help users understand how long a run took [3][4]. The CLI calculates this elapsed time internally as updatedAt minus startedAt [4]. Important Caveats - Accuracy: Because the elapsed time is derived from updatedAt, it can be misleading if the run is updated for reasons other than its completion (e.g., if it is modified or interacted with long after it has finished) [4]. This can lead to erroneously large or inaccurate duration values for older runs [4]. - Status vs. Conclusion: The command's status filter combines both status (e.g., in_progress, completed) and conclusion (e.g., success, failure) into a single string [5]. This is a known simplification that abstracts the more granular separation found in the underlying GitHub REST API [5]. If you require precise completion data, you may need to use gh run view to fetch more detailed metadata for a specific run ID, though even then, deriving exact completion time remains subject to how the GitHub API reports the updatedAt field [6][4].

Citations:

🌐 Web query:

site:cli.github.com gh run list json updatedAt createdAt completedAt

💡 Result:

The gh run list command supports the --json flag, which allows you to specify a comma-separated list of fields to include in the output [1][2]. The fields updatedAt, createdAt, and startedAt are available for use with this flag [1]. Note that completedAt is not a standard field name for this command; workflow run completion time is typically represented by the updatedAt field once the run has finished [1]. To use these fields, you can execute the command as follows: gh run list --json createdAt,updatedAt,name,status If you need to verify or list all available JSON fields for the command, you can run gh run list --json without any arguments, which will output the full list of supported fields [2].

Citations:

Filter on updatedAt here
gh run list does not expose a dedicated completion timestamp, and createdAt will miss runs that start before the cutoff but fail after it. Use updatedAt as the cutoff field in this filter.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/dependabot-failure-watcher.yml around lines 35 - 36,
Update the jq filter in the Dependabot failure watcher workflow to compare the
cutoff against each run’s updatedAt field instead of createdAt. Keep the
existing failure conclusion conditions and output fields unchanged.

count=$(echo "$failures" | jq 'length')
Comment on lines +29 to +37
if [ "$count" -gt 0 ]; then
echo "::error::$count failed Dependabot update run(s) in the last 8 days:"
echo "$failures" | jq -r '.[] | "- \(.displayTitle) (\(.createdAt))\n \(.url)"'
exit 1
fi
echo "No failed Dependabot update runs in the last 8 days."
Loading