feat: repair Dependabot pull requests automatically by cryptodev-2s · Pull Request #10231 · MetaMask/core

cryptodev-2s · 2026-09-14T17:23:42Z

Explanation

Dependabot's pull requests cannot merge on their own. Its security updates walk manifests one at a time rather than treating the Yarn workspace as one project, so a dependency ends up with different ranges in different packages and yarn constraints fails. It also does not deduplicate yarn.lock and does not write changelog entries. #10147, #10157, #10177 and #9369 are all stuck on this.

This adds a workflow that repairs all three and pushes the result back. It runs yarn constraints --fix with ALIGN_DEPENDENCY_RANGES=true (the opt in from #10228, whose only intended caller is this workflow), reinstalls, deduplicates, then runs the changelog fixer that already exists. Order matters: aligning ranges rewrites manifests but leaves yarn.lock stale.

It also adds @lavamoat/* to the npm allowlist. Both that and @metamask/* are already in npmPreapprovedPackages, so neither can trip the Yarn age gate during the repair install. Note that allow only governs version updates, so the workflow will also act on security pull requests for other packages, which is where the constraints failures come from.

Notes

pull_request, not pull_request_target. Dependabot runs get a read only token and no secrets, so the push is authorised by the OIDC exchange, the same way snaps does it.
opened and reopened only. The job pushes to the pull request branch, so synchronize would loop.
[dependabot skip] on the commit, otherwise Dependabot rebases and wipes the repair.

Verification

The workflow cannot run until it is on the default branch. Checked locally:

Check	Result
`constraints --fix` leaves `yarn.lock` stale	confirmed, hence the reinstall step
`ALIGN_DEPENDENCY_RANGES=true yarn constraints --fix` on a split range	aligns all 25 manifests, exit 0
Default, without the variable	unchanged, still errors

References

Follows #10225 and #10228. Part of WPC-1161. Pattern borrowed from MetaMask/snaps update-pull-request.yml.

Checklist

I've updated the test suite for new or updated code as appropriate (workflow and config only)
I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
I've communicated my changes to consumers by updating changelogs for packages I've changed (no published package is touched)
I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

Note

Low Risk
Changes are limited to Dependabot and CI workflow configuration; no runtime application or auth logic is modified, though the workflow does push commits to Dependabot branches via OIDC token exchange.

Overview
Adds a GitHub Actions workflow that runs when Dependabot opens or reopens a PR, then fixes the common reasons those PRs fail CI: misaligned dependency ranges across the Yarn workspace, a stale or duplicated yarn.lock, and missing changelog entries.

The job exchanges an OIDC token for write access (Dependabot’s default token cannot push), runs yarn constraints --fix with ALIGN_DEPENDENCY_RANGES=true, reinstalls with --no-immutable, dedupes, and runs the existing changelog:validate --fix flow before committing with [dependabot skip] so Dependabot does not rebase away the repair. It only listens to opened / reopened (not synchronize) to avoid a push loop.

Dependabot config now allows version bumps for @lavamoat/* npm packages, matching @metamask/*, so those updates can go through the same repair path without Yarn age-gate issues during install.

^{Reviewed by Cursor Bugbot for commit c90706d. Bugbot is set up for automated code reviews on this repo. Configure here.}

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3f2ea68. Configure here.}

mcmire

Makes sense, just left a few comments/suggestions.

mcmire · 2026-09-14T18:31:27Z

+      # Aligning ranges rewrites manifests but not the lockfile, so it has to be resolved again before deduplicating.
+      - name: Resolve the lockfile
+        run: yarn install --no-immutable


Will --no-immutable work here? My understanding is that we use this in workflows when we've updated the lockfile in Git but we want Yarn to install dependencies, and we don't want Yarn to update the lockfile anymore. However in this case we do need to update the lockfile (because we're changing versions of dependencies), so maybe we need to drop --no-immutable? (Also, if we rephrase this step as "apply dependency range updates" maybe we don't need the comment?)

Suggested change

# Aligning ranges rewrites manifests but not the lockfile, so it has to be resolved again before deduplicating.

- name: Resolve the lockfile

run: yarn install --no-immutable

- name: Apply dependency range updates

run: yarn install

Actually why we can't useyarn install as ub the CI it defaults to --immutable and forbids lockfile changes, We need--no-immutable to allow this as the previous step we regenerate the lock.

Oh, right, I got mixed up. Thanks.

mcmire · 2026-09-14T18:31:54Z

+      - name: Deduplicate the lockfile
+        run: yarn dedupe


Nit: We aren't deduplicating the lockfile per se, we're deduplicating the dependency tree, which the lockfile represents.

Suggested change

- name: Deduplicate the lockfile

run: yarn dedupe

- name: Deduplicate dependency tree

run: yarn dedupe

Reworded here 67b5b17

mcmire · 2026-09-14T18:36:05Z

+          git config user.name 'MetaMask Bot'
+          git config user.email 'metamaskbot@users.noreply.github.com'


Nit: Since the token comes from metamask-ci do we want to use that instead? (this is copied from https://github.com/MetaMask/core-platform-metrics/blob/7b14be72749417587c6ab6b423b9455114292adc/.github/workflows/remove-dashboard-preview.yml#L49C1-L51C1)

Suggested change

git config user.name 'MetaMask Bot'

git config user.email 'metamaskbot@users.noreply.github.com'

git config user.name "metamask-ci[bot]"

git config user.email "271559518+metamask-ci[bot]@users.noreply.github.com"

Applied here #10231

mcmire

One more question.

mcmire · 2026-09-14T19:41:31Z

+jobs:
+  repair:
+    name: Repair constraints, lockfile and changelogs
+    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' && github.actor != 'metamask-ci[bot]' }}


Do you need to check that this doesn't come from metamask-ci? Is it enough to check that it comes from Dependabot?

Suggested change

if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' && github.actor != 'metamask-ci[bot]' }}

if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}

Indeed its redundant and we don't use synchronise here

Dropped here c90706d

mcmire

LGTM!

feat: repair Dependabot pull requests automatically

8acf964

cryptodev-2s self-assigned this Sep 14, 2026

cryptodev-2s added 2 commits September 14, 2026 20:01

chore: unwrap workflow comments

0c72077

chore: drop redundant workflow comments

3f2ea68

cryptodev-2s marked this pull request as ready for review September 14, 2026 18:10

cryptodev-2s requested a review from a team as a code owner September 14, 2026 18:10

cryptodev-2s deployed to default-branch September 14, 2026 18:10 — with GitHub Actions Active

cursor Bot reviewed Sep 14, 2026

View reviewed changes

Comment thread .github/workflows/repair-dependabot-pull-requests.yml Outdated

mcmire reviewed Sep 14, 2026

View reviewed changes

chore: address review feedback on the repair workflow

67b5b17

cryptodev-2s requested a review from mcmire September 14, 2026 19:34

cryptodev-2s enabled auto-merge September 14, 2026 19:34

mcmire reviewed Sep 14, 2026

View reviewed changes

chore: drop redundant actor check

c90706d

cryptodev-2s requested a review from mcmire September 14, 2026 20:04

mcmire approved these changes Sep 14, 2026

View reviewed changes

cryptodev-2s added this pull request to the merge queue Sep 14, 2026

Merged via the queue into main with commit 1e24fce Sep 14, 2026
338 checks passed

cryptodev-2s deleted the feat/repair-dependabot-pull-requests branch September 14, 2026 20:42

		git config user.name 'MetaMask Bot'
		git config user.email 'metamaskbot@users.noreply.github.com'

	if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' && github.actor != 'metamask-ci[bot]' }}
	if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}

Uh oh!

Uh oh!

Conversation

cryptodev-2s commented Sep 14, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Explanation

Notes

Verification

References

Checklist

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mcmire left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cryptodev-2s Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mcmire left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mcmire left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cryptodev-2s commented Sep 14, 2026 •

edited by cursor Bot

Loading

cryptodev-2s Sep 14, 2026 •

edited

Loading