You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by "DaanHoogland (via GitHub)" <gi...@apache.org> on 2026/03/31 07:57:04 UTC
[I] deal with dependabot updates and failures [cloudstack]
DaanHoogland opened a new issue, #12923:
URL: https://github.com/apache/cloudstack/issues/12923
As a developer/release manager I would like for dependabot's updates to be applicable. At the moment all GHA for dependabot's PRs fail the updates do not seem to be appropriate even when the simplest tiny upgrades are attempted. It would be nice to be able to just apply these.
This situation mostly applies to the JS updates, but also mvn updates fail when attempted.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] deal with dependabot updates and failures [cloudstack]
Posted by "dheeraj12347 (via GitHub)" <gi...@apache.org>.
dheeraj12347 commented on issue #12923:
URL: https://github.com/apache/cloudstack/issues/12923#issuecomment-4243240860
I’d like to investigate why Dependabot PRs are failing (JS and Maven) and propose fixes to make these updates applicable. I’ll start by analyzing recent Dependabot PR CI logs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] deal with dependabot updates and failures [cloudstack]
Posted by "winterhazel (via GitHub)" <gi...@apache.org>.
winterhazel commented on issue #12923:
URL: https://github.com/apache/cloudstack/issues/12923#issuecomment-4401616715
(copied from #13042)
The failures seems to be related to https://github.com/codecov/codecov-action?tab=readme-ov-file#dependabot.
@dependabot opens PRs from the original repository instead of a fork, which requires it to have access to the Codecov token for the coverage check to execute. The Codecov token is probably not present in the @dependabot secrets.
We need to ask someone with enough permission to configure the @dependabot secrets and grant it access to the Codecov token.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] deal with dependabot updates and failures [cloudstack]
Posted by "dheeraj12347 (via GitHub)" <gi...@apache.org>.
dheeraj12347 commented on issue #12923:
URL: https://github.com/apache/cloudstack/issues/12923#issuecomment-4279569874
I looked into a few recent Dependabot PRs to see why they’re failing CI.
JS / UI PRs
#13036 (dompurify 3.2.6 → 3.4.0 in /ui):
build.yml passes; only “TestHook interrupted while sleeping” shows up in the logs.
ui.yml fails in the codecov/codecov-action@v4 step. The Codecov CLI logs show {"message":"Token required because branch is protected"} for the branch dependabot/npm_and_yarn/ui/dompurify-3.4.0, and the action exits with code 1.
I don’t see npm ci / npm run build failing here, so this looks like a Codecov + protected-branch issue, not a dompurify issue.
#12987 (fast-xml-parser 4.3.0 → 4.5.6 in /ui):
build.yml also passes with the same “TestHook interrupted while sleeping” messages.
The red checks come from UI Build and simulator/coverage workflows, not from the main Maven build.
Maven PRs
#12916 (maven-dependency-plugin 3.9.0 → 3.10.0):
ui.yml again fails at codecov/codecov-action@v4 with the same pattern: Codecov runs create-commit, gets HTTP 400 with {"message":"Token required because branch is protected"}, and fails the job.
#12915 (org.springframework.version 5.3.26 → 7.0.6):
ui.yml shows the same Codecov failure and Node 20 deprecation warning for codecov/codecov-action@v4.
From these, it looks like many Dependabot PRs (JS and Maven) are being marked failed mainly because Codecov cannot operate on protected Dependabot branches without a token, and because of shared simulator/coverage workflow issues, rather than because the underlying dependency bumps immediately break the main build.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org