XS✔ ◾ Add Agentic CI Dependency Workflow#787
Merged
Merged
Conversation
Implements the update-ci-dependencies skill via gh-aw. Triggered on Release – Initiate completion (and workflow_dispatch) so refreshed CI pins land on the release pull request automatically.
- Remove quotes around workflow name for consistency. - Simplify tool command syntax by removing quotes. - Enhance documentation for clarity and structure. - Ensure Node.js version consistency across workflows and pipelines.
Member
Author
PR Metrics✔ Thanks for keeping your pull request small.
Metrics computed by PR Metrics. Add it to your Azure DevOps and GitHub PRs! |
muiriswoulfe
changed the title
Member
Author
Super-linter summary
All files and directories linted successfully For more information, see the GitHub Actions workflow run Powered by Super-linter |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds an “agentic” dependency-refresh workflow intended to keep CI/CD pins (GitHub Actions SHAs + version comments, Azure DevOps task majors/template refs) and Node.js runtime pins consistent, primarily during release PRs.
Changes:
- Introduces a new Copilot-driven dependency refresh workflow definition/instructions.
- Defines trigger intent (
workflow_runafter “Release – Initiate” andworkflow_dispatch) and a “push onto release PR branch” output target with file edit constraints.
Member
Author
Super-linter summary
All files and directories linted successfully For more information, see the GitHub Actions workflow run Powered by Super-linter |
Member
Author
Super-linter summary
All files and directories linted successfully For more information, see the GitHub Actions workflow run Powered by Super-linter |
Bare `*` values in `checkout.fetch` and `safe-outputs.push-to-pull-request-branch.target` were being parsed as YAML alias references, which made the frontmatter fail to load. Quoting them as `"*"` makes them valid string scalars.
Member
Author
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter CHECKOV |
- Add Microsoft copyright headers to Checkov, commitlint, and Trivy
configs to match the repo convention.
- Ignore WTFPL (truncate-utf8-bytes transitive dep) in Trivy.
- Fix natural-language hyphenation ("client-side") in the
update-ci-dependencies workflow description.
Member
Author
Super-linter summary
All files and directories linted successfully For more information, see the GitHub Actions workflow run Powered by Super-linter |
- Move .commitlintrc.yml to the repo root so Super-Linter's commitlint search picks it up. - Enable SAVE_SUPER_LINTER_SUMMARY since PR summary comments are on by default. - Disable Biome lint (ESLint/Stylelint own JS and CSS) and Python Black (Ruff covers Python; this repo has none anyway).
muiriswoulfe
had a problem deploying
to
production
GitHub Actions
Failure
Member
Author
Super-linter summary
Super-linter detected linting errors For more information, see the GitHub Actions workflow run Powered by Super-linter GIT_COMMITLINT |
muiriswoulfe
force-pushed
the
muiriswoulfe/agentic-workflow
branch
from
64f4347 to
9336be2
Compare
Member
Author
Super-linter summary
All files and directories linted successfully For more information, see the GitHub Actions workflow run Powered by Super-linter |
- Replace the .github/workflows/*.yml glob with an explicit list (build.yml, release-initiate.yml, release-publish.yml) so the agent cannot patch the gh-aw-generated update-ci-dependencies.lock.yml. - Remove the az authentication fallback from the template-ref step because az is not in the workflow's bash allowlist; tell the agent to leave the current ref in place and report the miss instead.
Member
Author
Super-linter summary
All files and directories linted successfully For more information, see the GitHub Actions workflow run Powered by Super-linter |
neilr81
approved these changes
Apr 24, 2026
Member
Author
Super-linter summary
All files and directories linted successfully For more information, see the GitHub Actions workflow run Powered by Super-linter |
Member
Author
Super-linter summary
All files and directories linted successfully For more information, see the GitHub Actions workflow run Powered by Super-linter |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Introduces an agentic workflow that refreshes pinned CI/CD dependencies for this repository. Triggered when the Release – Initiate workflow completes – or by manual dispatch while a release is in flight – the agent identifies the open release pull request and pushes dependency updates directly onto its branch.
Scope
Impact
Release preparation no longer requires a manual dependency-refresh sweep. Each release pull request arrives with pins already updated, and an automatic retrigger commit causes the existing Build loop to run against the updates. Out-of-release invocations are no-ops, so the workflow is safe to re-dispatch.