chore: consolidate dependabot config using directories array by janisz · Pull Request #19754 · stackrox/stackrox

janisz · 2026-04-01T16:44:05Z

Description

Migrate from individual directory entries to the new 'directories' (plural) array feature announced in GitHub's public beta. This maximizes consolidation to reduce duplication while maintaining all existing functionality.

User-facing documentation

CHANGELOG.md is updated OR update is not needed
documentation PR is created and is linked above OR is not needed

Testing and quality

the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
CI results are inspected

Automated testing

How I validated my change

change me!

Migrate from individual directory entries to the new 'directories' (plural) array feature announced in GitHub's public beta. This maximizes consolidation to reduce duplication while maintaining all existing functionality. Changes: - Consolidate 14 gomod entries into 2 entries (86% reduction) - Root module (special config with daily schedule, ignore/groups) - All tool modules (13 directories with weekly schedule) - Consolidate 9 github-actions entries into 1 entry (89% reduction) - Root workflows + all local actions in one consolidated entry - Consolidate 6 docker entries into 1 entry, added 4 missing images (10 total) - Added: ci/splunk, image/roxctl, scale/image, scanner/image/scannerctl - Reduce file size from 479 to 151 lines (68% reduction) - Update validation script to support both singular and plural formats Overall: 22 entries → 6 entries (73% reduction) All go.mod files maintain dependabot coverage. Some specific labels were removed for simplification (area/operator, area/scanner, ci-all-qa-tests, auto-merge, auto-retest), keeping only "dependencies" label. The monthly schedule for operator/tests/controller/metrics was changed to weekly for consistency. User request: Consolidate all go.mod, docker, and github-actions entries; verify all Dockerfiles are handled. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

sourcery-ai

Hey - I've left some high level feedback:

In the consolidated gomod tools entry, some directories that previously had the area/operator label (e.g., under /operator/tools/...) now only get the generic dependency labels; confirm whether losing the more specific area label is intentional or reintroduce it via a separate entry or additional labels.
The previous operator-sdk gomod configuration had a groups.operator-framework grouping which is dropped in the consolidated gomod block; if that grouping is still desired, it should be preserved on the new multi-directory entry or split out into its own config.
Several docker directories that used to carry the ci-all-qa-tests (and in some cases area/operator) label (e.g., image/rhel, image/postgres, scanner/image/*, operator/…) now only get the generic dependency label in the consolidated docker entry; please verify that this behavior change is intended or restore the tailored labels where needed.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- In the consolidated gomod tools entry, some directories that previously had the `area/operator` label (e.g., under `/operator/tools/...`) now only get the generic dependency labels; confirm whether losing the more specific area label is intentional or reintroduce it via a separate entry or additional labels.
- The previous `operator-sdk` gomod configuration had a `groups.operator-framework` grouping which is dropped in the consolidated gomod block; if that grouping is still desired, it should be preserved on the new multi-directory entry or split out into its own config.
- Several docker directories that used to carry the `ci-all-qa-tests` (and in some cases `area/operator`) label (e.g., `image/rhel`, `image/postgres`, `scanner/image/*`, `operator/…`) now only get the generic dependency label in the consolidated docker entry; please verify that this behavior change is intended or restore the tailored labels where needed.

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

coderabbitai · 2026-04-01T16:47:56Z

📝 Walkthrough

Summary by CodeRabbit

Chores
- Updated Dependabot configuration structure for managing Go module dependencies, Docker image updates, and GitHub Actions automation to use consolidated directory-based groupings instead of separate per-directory entries.
- Updated CI dependency validation and checking scripts to properly parse and process the restructured Dependabot configuration format while maintaining accurate dependency tracking.

Walkthrough

The pull request consolidates multiple Dependabot ecosystem entries (gomod, docker, github-actions) using a new directories array feature to eliminate per-directory duplication. A CI validation script is updated to parse both singular directory and plural directories configuration fields.

Changes

Cohort / File(s)	Summary
Dependabot Configuration Consolidation `.github/dependabot.yaml`	Consolidated multiple separate entries for `gomod`, `docker`, and `github-actions` ecosystems into fewer entries using `directories: [...]` arrays. Removed per-subdirectory duplication while preserving schedules, open-pull-requests-limit, labels, and commit-message settings.
CI Script Update `scripts/ci/jobs/check-dependabot-gomod.sh`	Updated parsing logic to extract `package-ecosystem=="gomod"` directories from both singular `.directory` and plural `.directories[]` fields, unionizing results before normalization and sorting.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The description provides the required template structure but contains incomplete sections: the validation placeholder 'change me!' remains unfilled, and testing checkboxes are unchecked without explanation.	Complete the 'How I validated my change' section with specific validation details, explain why testing checkboxes are not marked, or confirm if validation occurred post-merge.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: consolidating dependabot configuration using the directories array feature to reduce duplication.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch simplify_dependabot

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

🧹 Nitpick comments (2)

.github/dependabot.yaml (2)

78-104: Consolidation of tool modules looks correct.

The 13 tool module directories are properly consolidated. Minor observation: line 82 has a trailing slash (/operator/tools/envtest/) while others don't. This likely works but is inconsistent.

Optional: Remove trailing slash for consistency

    directories:
      - '/operator/tools/controller-gen'
-     - '/operator/tools/envtest/'
+     - '/operator/tools/envtest'
      - '/operator/tools/kubebuilder/'

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/dependabot.yaml around lines 78 - 104, The directories list in the
dependabot configuration has an inconsistent trailing slash: change the entry
'/operator/tools/envtest/' to '/operator/tools/envtest' to match the other
directory entries in the package-ecosystem block and keep path formatting
consistent with the existing entries (check the directories array that contains
'/operator/tools/controller-gen', '/operator/tools/kubebuilder/', etc., and
update only the '/operator/tools/envtest/' string).

106-127: Docker paths use relative format while others use absolute.

Docker directories (lines 109-118) lack the leading / prefix used consistently in gomod and github-actions sections. Both formats work, but the inconsistency may cause confusion for maintainers.

Optional: Add leading `/` for consistency

  - package-ecosystem: 'docker'
    directories:
-     - 'ci/splunk'
-     - 'image/postgres'
-     - 'image/rhel'
-     - 'image/roxctl'
-     - 'operator/'
-     - 'operator/tests/controller/metrics'
-     - 'scale/image'
-     - 'scanner/image/db'
-     - 'scanner/image/scanner'
-     - 'scanner/image/scannerctl'
+     - '/ci/splunk'
+     - '/image/postgres'
+     - '/image/rhel'
+     - '/image/roxctl'
+     - '/operator'
+     - '/operator/tests/controller/metrics'
+     - '/scale/image'
+     - '/scanner/image/db'
+     - '/scanner/image/scanner'
+     - '/scanner/image/scannerctl'

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/dependabot.yaml around lines 106 - 127, The Docker dependabot entry
(package-ecosystem: 'docker') uses relative paths in the directories list;
update each entry in that list (the strings under directories for the docker
block) to use the same leading '/' style as other sections (e.g., change
'ci/splunk' to '/ci/splunk', 'image/postgres' to '/image/postgres', etc.) so the
form is consistent with gomod and github-actions entries while leaving other
keys (schedule, labels, commit-message) unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.github/dependabot.yaml:
- Around line 78-104: The directories list in the dependabot configuration has
an inconsistent trailing slash: change the entry '/operator/tools/envtest/' to
'/operator/tools/envtest' to match the other directory entries in the
package-ecosystem block and keep path formatting consistent with the existing
entries (check the directories array that contains
'/operator/tools/controller-gen', '/operator/tools/kubebuilder/', etc., and
update only the '/operator/tools/envtest/' string).
- Around line 106-127: The Docker dependabot entry (package-ecosystem: 'docker')
uses relative paths in the directories list; update each entry in that list (the
strings under directories for the docker block) to use the same leading '/'
style as other sections (e.g., change 'ci/splunk' to '/ci/splunk',
'image/postgres' to '/image/postgres', etc.) so the form is consistent with
gomod and github-actions entries while leaving other keys (schedule, labels,
commit-message) unchanged.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: f5bb9c71-51bf-4e49-88da-b16cc3294df9

📥 Commits

Reviewing files that changed from the base of the PR and between c3cccf6 and 43534a5.

📒 Files selected for processing (2)

.github/dependabot.yaml
scripts/ci/jobs/check-dependabot-gomod.sh

codecov · 2026-04-01T16:49:32Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.59%. Comparing base (2837c9b) to head (43534a5).
⚠️ Report is 5 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #19754   +/-   ##
=======================================
  Coverage   49.59%   49.59%           
=======================================
  Files        2756     2756           
  Lines      208036   208036           
=======================================
  Hits       103183   103183           
  Misses      97192    97192           
  Partials     7661     7661

Flag	Coverage Δ
go-unit-tests	`49.59% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

rhacs-bot · 2026-04-01T16:58:02Z

Images are ready for the commit at 43534a5.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.11.x-525-g43534a58b5.

porridge · 2026-04-02T05:54:47Z

.github/dependabot.yaml

-    schedule:
-      interval: 'weekly'
-      day: 'wednesday'
-    open-pull-requests-limit: 3


Is the open pull request limit of three now shared across all the directories or still per directory?

You're right, this will apply to all deps. then it makes not use for us

Why not just bump it to 20 or so?

porridge · 2026-04-02T05:55:33Z

.github/dependabot.yaml

-    open-pull-requests-limit: 3
-    labels:
-    - "dependencies"
-    - "area/operator"


I don't know why we needed the area/* labels but we will lose this now. Is this not a problem?

I think labeler will add it back:

stackrox/.github/labeler.yml

Lines 23 to 25 in 496d0ac

area/operator:

- changed-files:

- any-glob-to-any-file:

porridge · 2026-04-02T05:56:28Z

.github/dependabot.yaml

-    groups:
-      operator-framework:
-        patterns:
-        - "github.com/operator-framework/*"


I think we need this to keep our sanity...

porridge · 2026-04-02T05:57:51Z

.github/dependabot.yaml

      day: 'wednesday'
    open-pull-requests-limit: 3
    labels:
-    - "ci-all-qa-tests"


Why drop this label?

janisz requested a review from a team as a code owner April 1, 2026 16:44

janisz requested review from porridge and removed request for a team April 1, 2026 16:44

github-actions bot added area/ci ai-review coderabbit-review labels Apr 1, 2026

sourcery-ai bot reviewed Apr 1, 2026

View reviewed changes

coderabbitai bot reviewed Apr 1, 2026

View reviewed changes

porridge requested changes Apr 2, 2026

View reviewed changes

janisz closed this Apr 2, 2026

Conversation

janisz commented Apr 1, 2026

Description

User-facing documentation

Testing and quality

Automated testing

How I validated my change

Uh oh!

sourcery-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot commented Apr 1, 2026

Summary by CodeRabbit

Walkthrough

Changes

Estimated code review effort

❌ Failed checks (1 inconclusive)

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

rhacs-bot commented Apr 1, 2026

Uh oh!

porridge Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

janisz Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

porridge Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

porridge Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

janisz Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

porridge Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

porridge Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

codecov bot commented Apr 1, 2026 •

edited

Loading