[PR #94] [MERGED] ci: add Dependabot for third-party actions, ignoring self-references #104

New issue

Closed

opened 2026-10-26 22:36:15 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-26 22:36:15 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/Comfy-Org/github-workflows/pull/94
Author: @mattmillerai
Created: 7/30/2026
Status: ✅ Merged
Merged: 7/30/2026
Merged by: @mattmillerai

Base: main ← Head: matt/add-dependabot

📝 Commits (3)

23fd3bc ci: add Dependabot for third-party actions, ignoring self-references
10da052 ci(dependabot): address cursor-review panel findings
bbac95d ci(dependabot): drop unsupported semver-major-days from the github-actions cooldown

📊 Changes

1 file changed (+99 additions, -0 deletions)

View changed files

➕ .github/dependabot.yml (+99 -0)

📄 Description

ELI-5

This repo tells other repos how to run their CI. Inside those instructions it refers to other people's building blocks — actions/checkout and friends — and it names each one by an exact, permanent ID rather than "the latest one". That is the safe way to do it: "latest" can be swapped out from under you, and these workflows run inside other repos with their secrets.

The catch is that an exact ID never changes on its own. So when one of those building blocks gets a security fix, nothing here notices, nothing turns red, and every repo that uses these workflows keeps running the old one. This turns on the robot that opens a PR when a new version appears.

It also tells that robot to keep its hands off our own workflows, because those need to be updated in a specific way it does not understand.

Why this matters more than the repo size suggests

There was no dependabot.yml here at all. 11 third-party actions are pinned by full SHA today. A stale action in this repo is stale in every caller simultaneously — cloud, comfy-cloud-mcp-server, comfy-local-mcp, comfy-infra — and several of these workflows hold a bot App token with contents / pull-requests / issues write.

The `Comfy-Org/*` ignore is the load-bearing part

Dependabot must never bump this repo's own reusables in a caller. A groom/cursor-review/agents-md caller pins the reusable twice:

uses: Comfy-Org/github-workflows/.github/workflows/groom.yml@<sha>
with:
  workflows_ref: <the same sha>   # loads the matching briefs + scripts at RUN TIME

Those two must stay in lock-step, or a run executes one version's workflow against another version's scripts. Dependabot only understands uses: — it rewrites the SHA and leaves workflows_ref: behind.

This is not hypothetical. Comfy-Org/cloud#5676 is doing it right now:

-uses: ...groom.yml@f4cbb50ff3... # main @ f4cbb50
+uses: ...groom.yml@ece4c3eaa7... # main @ f4cbb50   <- comment now wrong too
 with:
   workflows_ref: f4cbb50ff3...                      <- NOT bumped

It also flattens deliberate pins: assign-reviewers.yml was pinned to a32ed21 with a comment explaining it is the reviewed merge SHA of github-workflows#41, and Dependabot rewrites it to the same ece4c3e as everything else — because it treats every reusable in this repo as one dependency named "Comfy-Org/github-workflows".

bump-callers.sh rewrites both pins and is the only thing that should move them. The same ignore belongs in every consumer repo's dependabot.yml; a follow-up PR adds it to cloud.

Choices

Monthly + grouped, matching cloud's github-actions cadence. Each merge here obliges a fleet-wide caller bump (the bump-*-callers workflows open those automatically), so batching keeps that to one bump per cycle instead of one per action.
cooldown: 1 day, so a botched release is usually yanked before it reaches consumer CI.
open-pull-requests-limit: 2, same as cloud.

Testing

dependabot.yml is config — it has no test to run. Validated by parsing it (version: 2, one github-actions ecosystem, group present, Comfy-Org/* ignore present). The real proof is the first PR Dependabot opens; if the ignore is wrong it will show up immediately as a caller-pin bump, which is exactly what this PR exists to prevent.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Comfy-Org/github-workflows/pull/94 **Author:** [@mattmillerai](https://github.com/mattmillerai) **Created:** 7/30/2026 **Status:** ✅ Merged **Merged:** 7/30/2026 **Merged by:** [@mattmillerai](https://github.com/mattmillerai) **Base:** `main` ← **Head:** `matt/add-dependabot` --- ### 📝 Commits (3) - [`23fd3bc`](https://github.com/Comfy-Org/github-workflows/commit/23fd3bc23f90db8551ec7cf4c51a5f8e9c4c28e9) ci: add Dependabot for third-party actions, ignoring self-references - [`10da052`](https://github.com/Comfy-Org/github-workflows/commit/10da05239c95cf62732e943e3ee6074c9db15414) ci(dependabot): address cursor-review panel findings - [`bbac95d`](https://github.com/Comfy-Org/github-workflows/commit/bbac95d0f9a8ad75ebba359ee6319f9cdeab3a01) ci(dependabot): drop unsupported semver-major-days from the github-actions cooldown ### 📊 Changes **1 file changed** (+99 additions, -0 deletions) <details> <summary>View changed files</summary> ➕ `.github/dependabot.yml` (+99 -0) </details> ### 📄 Description ## ELI-5 This repo tells other repos how to run their CI. Inside those instructions it refers to other people's building blocks — `actions/checkout` and friends — and it names each one by an exact, permanent ID rather than "the latest one". That is the safe way to do it: "latest" can be swapped out from under you, and these workflows run inside other repos with their secrets. The catch is that an exact ID never changes on its own. So when one of those building blocks gets a security fix, nothing here notices, nothing turns red, and every repo that uses these workflows keeps running the old one. This turns on the robot that opens a PR when a new version appears. It also tells that robot to keep its hands off *our own* workflows, because those need to be updated in a specific way it does not understand. ## Why this matters more than the repo size suggests There was no `dependabot.yml` here at all. 11 third-party actions are pinned by full SHA today. A stale action in this repo is stale in **every caller simultaneously** — cloud, comfy-cloud-mcp-server, comfy-local-mcp, comfy-infra — and several of these workflows hold a bot App token with `contents` / `pull-requests` / `issues` write. ## The `Comfy-Org/*` ignore is the load-bearing part Dependabot must never bump this repo's own reusables in a caller. A groom/cursor-review/agents-md caller pins the reusable **twice**: ```yaml uses: Comfy-Org/github-workflows/.github/workflows/groom.yml@<sha> with: workflows_ref: <the same sha> # loads the matching briefs + scripts at RUN TIME ``` Those two must stay in lock-step, or a run executes one version's workflow against another version's scripts. **Dependabot only understands `uses:`** — it rewrites the SHA and leaves `workflows_ref:` behind. This is not hypothetical. [Comfy-Org/cloud#5676](https://github.com/Comfy-Org/cloud/pull/5676) is doing it right now: ```diff -uses: ...groom.yml@f4cbb50ff3... # main @ f4cbb50 +uses: ...groom.yml@ece4c3eaa7... # main @ f4cbb50 <- comment now wrong too with: workflows_ref: f4cbb50ff3... <- NOT bumped ``` It also flattens deliberate pins: `assign-reviewers.yml` was pinned to `a32ed21` with a comment explaining it is the reviewed merge SHA of github-workflows#41, and Dependabot rewrites it to the same `ece4c3e` as everything else — because it treats every reusable in this repo as one dependency named "Comfy-Org/github-workflows". `bump-callers.sh` rewrites **both** pins and is the only thing that should move them. The same ignore belongs in every consumer repo's `dependabot.yml`; a follow-up PR adds it to cloud. ## Choices - **Monthly + grouped**, matching cloud's `github-actions` cadence. Each merge here obliges a fleet-wide caller bump (the `bump-*-callers` workflows open those automatically), so batching keeps that to one bump per cycle instead of one per action. - **`cooldown: 1 day`**, so a botched release is usually yanked before it reaches consumer CI. - **`open-pull-requests-limit: 2`**, same as cloud. ## Testing `dependabot.yml` is config — it has no test to run. Validated by parsing it (`version: 2`, one `github-actions` ecosystem, group present, `Comfy-Org/*` ignore present). The real proof is the first PR Dependabot opens; if the ignore is wrong it will show up immediately as a caller-pin bump, which is exactly what this PR exists to prevent. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-26 22:36:15 +00:00