[ci-maintainer] fix: apply no-changelog label to dependabot PRs (.github/dependabot.yml) - #6191
Merged
Merged
Conversation
changelog-fragment-guard fails every dependabot PR touching src/ (go.mod/go.sum, Dockerfile, proxy npm): dependabot cannot author changelog.d fragments and dependabot.yml never applied the no-changelog label the guard's own dependency-churn exemption expects. Add no-changelog to the labels list of all four ecosystems so bumps pass the guard at PR-open time. Fixes #6190 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: sec-check <sec-check@hive.kubestellar.io>
kubestellar-prow
Bot
added
the
dco-signoff: yes
kubestellar-prow
Bot
added
the
size/XS
clubanderson
added
lgtm
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Contributor
|
Thank you for your contribution! Your PR has been merged. We'd love to hear how your experience was: share feedback |
kubestellar-hive Bot
added a commit
that referenced
this pull request
Sep 8, 2026
changelog-fragment-guard fails every dependabot PR touching src/ (go.mod/go.sum, Dockerfile, proxy npm): dependabot cannot author changelog.d fragments and dependabot.yml never applied the no-changelog label the guard's own dependency-churn exemption expects. Add no-changelog to the labels list of all four ecosystems so bumps pass the guard at PR-open time. Fixes #6190 Signed-off-by: sec-check <sec-check@hive.kubestellar.io> Co-authored-by: sec-check <sec-check@hive.kubestellar.io> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: sec-check <sec-check@hive.kubestellar.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
changelog-fragment-guardfails 100% of dependabot PRs that touchsrc/— gomod (src/go.mod/src/go.sum), docker (src/Dockerfile), and npm (src/proxy/**) bumps. The guard's own policy exempts dependency churn via theno-changeloglabel, but.github/dependabot.ymlonly appliesdependencies, and dependabot cannot authorchangelog.d/fragments. Every bump arrives red and needs a human to hand-apply the label — the same permanent-red pattern #5256 fixed for the NOTICE gate.Evidence: failing guard runs 34080466667, 34080464760, 34078063388, 34077903937, 34077887593 on PRs #6186/#6187 (2026-09-07).
Fix
Add
no-changelogto thelabels:list of all four ecosystems in.github/dependabot.yml. Dependabot applies configured labels at PR-open time and the guard reads labels from the event payload (and re-evaluates onlabeled), so bumps pass at first evaluation. No change to the guard itself; human PRs are unaffected.Scope: only
.github/dependabot.yml. No overlap with any open hold-gated PR.Fixes #6190
Opened by ci-maintainer agent (ACMM L4/L5 — hold-gated mode). Do not merge without human review;
holdlabel must stay until a human removes it.— hive: agent=ci-maintainer backend=copilot model=claude-fable-5