Repository navigation
ci: fix the dependency bot's instructions and make releases all-or-nothing - #52
Merged
Merged
Conversation
The 2026-10-05 run reached the model but gave up, reporting a network block. Nothing was blocked at the network: the commands it tried used curl, cd and timeout, which are outside the allowlist, so the whole command line was refused. The instructions now name the allowed commands and give dotnet-only ways to find newer versions, including the MAUI packages that Stellar.slnf leaves out. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Note
Copilot was unable to run its full agentic suite in this review.
Copilot review overview
Review effort: Lite
Findings: 1
Open (2)
What changed in this PR
Adds additional guidance to the dependency update workflow docs, focusing on the restricted shell environment and how to discover newer NuGet versions (including packages not included in the solution filter).
Changes:
- Documented the workflow shell allowlist constraints and common “permission denied” causes.
- Added steps/commands for listing outdated packages and manually looking up MAUI-related packages by package ID.
- Updated the workflow lock metadata to reflect the doc change.
| File | Description |
|---|---|
| .github/workflows/dependency-update.md | Adds documentation for the restricted shell + version discovery commands for dependency updates. |
| .github/workflows/dependency-update.lock.yml | Updates gh-aw metadata hashes due to the modified workflow markdown. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| `Microsoft.AspNetCore.Components.WebView.Maui`, `ReactiveUI.Maui.Reactive`, | ||
| `CommunityToolkit.Maui`, `CommunityToolkit.Maui.Markup`, `CommunityToolkit.Mvvm`, | ||
| `Mopups`): | ||
|
|
Comment on lines
+58
to
+60
| workflow's `tools.bash` list, the `git` commands needed to branch and commit, and | ||
| a few read-only basics (`cat`, `ls`, `grep`, `head`, `tail`, `sort`, `uniq`, `wc`, | ||
| `echo`, `printf`). A command line that |
…veUI hold The bot was told to apply skip-samples to batches with a major bump, while ci.yml says never to skip the samples for a major. The bot cannot build MAUI itself, so it now never applies the label. The ReactiveUI rule named ReactiveUI.SourceGenerators, which is on 3.x, as part of the 24.x line. The hold is also recorded beside the versions in Directory.Packages.props. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
A release that failed part-way left a version on nuget.org that could not be completed, as v2.1.3 did. Packing is now a matrix job that uploads its package, and a single publish job runs only when all of them succeeded. The push uses --skip-duplicate so a failed publish can be re-run. Packing also moves to the xcode-27 image with Xcode 27.0, matching ci.yml. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
michaelstonis
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Dependency bot. The model pin from #50 worked: the 2026-10-05 scheduled run (37343711720) started on
claude-sonnet-5. It then gave up and opened #51 reporting that network access was blocked. That diagnosis was wrong: the firewall summary shows 21 requests, 21 allowed, 0 blocked. What was refused were command lines containing commands outside the shell allowlist (curl, andcd … && timeout 60 dotnet restore …).echoanddotnet --versionran fine in the same session.Release workflow.
nuget.ymlbuilt, packed and pushed each package in its own matrix job, so a failure part-way left a version on nuget.org that could never be completed (v2.1.3: four of eleven packages). It also still ran onmacos-26, which CI moved off in #49.What
dependency-update.md:dotnet list Stellar.slnf package --outdated(and--highest-minor), plusdotnet package search <id> --exact-matchfor the MAUI packagesStellar.slnfleaves out.skip-samples— the bot was told to apply it to batches containing a major bump, whileci.ymlsays never to skip the samples for a major. The bot now never applies it; the label stays available to people. Theci.ymlcomment says so too.ReactiveUI.SourceGenerators(3.x) as part of the 24.x line. The same hold is recorded beside the versions inDirectory.Packages.props.nuget.yml:packmatrix job (fail-fast: false) builds and packs each package and uploads it as an artifact.publishjob needs everypackjob, downloads the packages and pushes them with--skip-duplicate.xcode-27with Xcode27.0, matchingci.yml.The bot's shell allowlist is unchanged.
Verification
develop.gh aw compile: 0 errors, 0 warnings.nuget.ymlparses, and a localdotnet packwrites one package to the path the upload step reads.🤖 Generated with Claude Code