Automated Dependency Management#255
Conversation
These transitive pins were a migration artefact from the pip-tools → uv move, added to reproduce the exact pip-compile environment during the transition. Now that the migration is verified, uv.lock is the sole source of truth for the full dependency graph. Keeping the constraints would have prevented uv from resolving fresh transitive deps when direct deps are bumped, blunting Renovate's automated updates. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
zandre-eng
requested review from
Charl1996,
ajeety4,
hemant10yadav,
mkangia,
pxwxnvermx and
sravfeyn
WalkthroughThis PR removes the Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsStopped waiting for pipeline failures after 30000ms. One of your pipelines takes longer than our 30000ms fetch window to run, so review may not consider pipeline-failure results for inline comments if any failures occurred after the fetch window. Increase the timeout if you want to wait longer or run a Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/security.yml (1)
32-32: ⚡ Quick winPin the
pip-audittool version for reproducible CI scans.Line [32] runs
uvx pip-auditunpinned, so scanner behavior can drift between runs and introduce flaky or unexpected CI outcomes. Pinning the tool version keeps audit results stable and easier to triage.Suggested fix
- - name: Run pip-audit - run: uvx pip-audit -r /tmp/requirements.txt + - name: Run pip-audit + run: uvx "pip-audit==<pinned_version>" -r /tmp/requirements.txt🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/security.yml at line 32, The uvx pip-audit command in the security workflow is running without a pinned version, which can cause inconsistent scan results between runs and lead to flaky CI outcomes. Pin the pip-audit tool version by specifying an explicit version constraint in the uvx command (for example, append the version number after pip-audit using the standard version pinning syntax) to ensure reproducible and stable security audit results across all workflow executions.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/security.yml:
- Around line 18-23: Replace the mutable GitHub Actions version tags with
immutable commit SHAs for supply-chain security. In the
.github/workflows/security.yml file, change the actions/checkout@v4 reference to
use a specific commit SHA instead of the v4 tag, and similarly change the
astral-sh/setup-uv@v4 reference to use its corresponding commit SHA. This
ensures that the workflow always runs the exact same code and prevents
unexpected changes from tag updates.
---
Nitpick comments:
In @.github/workflows/security.yml:
- Line 32: The uvx pip-audit command in the security workflow is running without
a pinned version, which can cause inconsistent scan results between runs and
lead to flaky CI outcomes. Pin the pip-audit tool version by specifying an
explicit version constraint in the uvx command (for example, append the version
number after pip-audit using the standard version pinning syntax) to ensure
reproducible and stable security audit results across all workflow executions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 5ee928a5-1079-47a2-8381-6d6c9316fb9f
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (3)
.github/workflows/security.ymlpyproject.tomlrenovate.json
💤 Files with no reviewable changes (1)
- pyproject.toml
|
The failing check is related to pip-audit failures which are pre-existing CVEs on main. These will be addressed by separate dependency bump PRs and do have tickets created for them. |
zandre-eng
force-pushed
the
ze/dependency-maintenance
branch
from
9a34b99 to
6af055e
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/dependency-management.md`:
- Around line 39-41: The documentation in docs/dependency-management.md
currently states that the security audit job runs on every pull request that
modifies pyproject.toml or uv.lock, but this is misleading because the workflow
is actually scoped to only run on PRs targeting the main branch. Update the
sentence starting with "Runs on every pull request" to clarify that the job runs
specifically on pull requests targeting main that modify pyproject.toml or
uv.lock, rather than implying it runs on all PRs that touch those files. This
narrows and clarifies the actual scope of when the workflow is triggered.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 1d7c2892-c872-4fa1-b183-dca462ebe58d
📒 Files selected for processing (1)
docs/dependency-management.md
zandre-eng
force-pushed
the
ze/dependency-maintenance
branch
from
6af055e to
a689388
Compare
- .github/dependabot.yml: native uv ecosystem + github-actions, weekly, max 5 concurrent PRs, minor/patch Python updates grouped into one PR. Matches the Dependabot+uv setup already used in commcare-hq. - .github/workflows/security.yml: runs pip-audit against production deps on PRs that touch pyproject.toml or uv.lock Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
zandre-eng
force-pushed
the
ze/dependency-maintenance
branch
from
a689388 to
bc6863d
Compare
There was a problem hiding this comment.
♻️ Duplicate comments (1)
docs/dependency-management.md (1)
12-12:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winAlign trigger scope text with the actual workflow.
Line 12 overstates behavior (“every PR”). The workflow is scoped to PRs targeting
mainthat touchpyproject.tomloruv.lock; this should match the table summary to avoid reviewer confusion.Suggested edit
-| **pip-audit** | Blocks PRs that introduce known CVEs | On every PR touching `pyproject.toml` / `uv.lock` | +| **pip-audit** | Blocks PRs that introduce known CVEs | On PRs targeting `main` touching `pyproject.toml` / `uv.lock` |🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/dependency-management.md` at line 12, The pip-audit table entry overstates the trigger scope by saying "On every PR touching `pyproject.toml` / `uv.lock`" when the actual workflow only runs on PRs targeting the main branch that touch those files. Update the trigger scope text in the pip-audit row to accurately reflect that the workflow is scoped to PRs targeting main, not every PR that modifies those files, so reviewers have correct expectations about when pip-audit checks are enforced.
🧹 Nitpick comments (1)
.github/dependabot.yml (1)
25-31: ⚡ Quick winAdd a PR concurrency cap for GitHub Actions updates
github-actionscurrently has noopen-pull-requests-limit, while the documented behavior says 5 per ecosystem. On Line 25, adding the same cap used in theuvsection keeps behavior aligned and avoids PR bursts.Proposed patch
- package-ecosystem: github-actions directory: '/' schedule: interval: weekly day: monday + open-pull-requests-limit: 5 labels: - dependencies🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/dependabot.yml around lines 25 - 31, The github-actions section in the dependabot configuration is missing an open-pull-requests-limit setting, which could result in PR bursts. Add an open-pull-requests-limit field to the github-actions package-ecosystem block with the same value used in the uv section to maintain consistent behavior across all ecosystems and align with the documented default behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@docs/dependency-management.md`:
- Line 12: The pip-audit table entry overstates the trigger scope by saying "On
every PR touching `pyproject.toml` / `uv.lock`" when the actual workflow only
runs on PRs targeting the main branch that touch those files. Update the trigger
scope text in the pip-audit row to accurately reflect that the workflow is
scoped to PRs targeting main, not every PR that modifies those files, so
reviewers have correct expectations about when pip-audit checks are enforced.
---
Nitpick comments:
In @.github/dependabot.yml:
- Around line 25-31: The github-actions section in the dependabot configuration
is missing an open-pull-requests-limit setting, which could result in PR bursts.
Add an open-pull-requests-limit field to the github-actions package-ecosystem
block with the same value used in the uv section to maintain consistent behavior
across all ecosystems and align with the documented default behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 00f36e64-43d9-481e-83f7-a4f4a01b0d87
📒 Files selected for processing (3)
.github/dependabot.yml.github/workflows/security.ymldocs/dependency-management.md
2 participants
Technical Summary
Link to ticket here
This is a release path 1 feature — Improvements to existing features & quick wins.
Sets up automated dependency maintenance for the repo. Rather than introduce Renovate (a third-party GitHub App), this uses Dependabot with its native
uvecosystem — the same setup already running in commcare-hq, keeping dependency tooling consistent across Dimagi repos. The change also removes the transitive-pin constraints left over from the pip-tools → uv migration so the lockfile is the sole source of truth and automated bumps can resolve fresh transitive deps.Logging and monitoring
No application logging or monitoring changes — this is CI/automation configuration only. Success is observable through GitHub itself: the Dependency graph / Dependabot tab (PRs opened on schedule) and the
Security Auditcheck status on dependency PRs.Safety Assurance
Safety story
Inherently low risk — no application code, models, migrations, or runtime behavior is touched. The Dependabot config only governs how update PRs are proposed; each resulting bump still arrives as its own reviewable PR that must pass full CI before merge, so nothing is upgraded automatically. The security workflow is additive and only gates PRs that modify dependency manifests. Removing the constraint pins does not change the currently installed versions (those remain pinned in
uv.lock) — it only allows future re-resolution;uv.lockwas regenerated and committed as part of that commit. Config files were validated by the repo's pre-commit hooks (YAML + prettier).Automated test coverage
No application tests are applicable, as there is no code change. The security workflow itself is the verification mechanism:
pip-auditruns in CI on any change topyproject.toml/uv.lock. The Dependabot and workflow YAML are validated by thecheck-yamlandprettierpre-commit hooks.QA Plan
QA will not be performed for this change.
Labels & Review