Repository navigation
Add Dependabot for actions and a weekly plugin update workflow - #12
Conversation
Dependabot can't update lazy.nvim plugins, so it only covers GitHub Actions: monthly, grouped, skipping gh-aw's generated *.lock.yml files. plugin-update.yml runs :Lazy update every Monday, commits lazy-lock.json to simonk/dev/plugin-update, opens or refreshes a PR with compare links, and dispatches CI on it so the smoke test covers the new commits. On PRs that change the updater it only does a dry run. The Neovim install steps move into .github/actions/setup-nvim so CI and the updater share them. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 90315f97-7c82-4bc1-9bf1-2f8460782554
|
/review |
|
✅ PR re-review completed successfully!
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
/review to retry.
The PR extracts a reusable setup-nvim action and adds a weekly plugin-update workflow, a Dependabot config and an updater script. The structure is clean, and the branch-ownership guard is a thoughtful touch.
Main findings:
- Supply chain (high):
nvimruns unreviewed plugin code and build steps while a write-scoped token is in the environment. Split it into a read-onlyupdatejob and apublishjob. - Force push (low): it can overwrite the branch when no PR is open.
- Docs (low): the reviewer agent still looks for the Neovim version in
ci.yml.
After merging: turn on Allow GitHub Actions to create and approve pull requests in Settings → Actions → General, as the README notes.
Review context and counts
| Reviewers | claude-reviewer (completed), gpt-reviewer (unavailable: model routing error, failed twice) |
| Raw findings | claude: 4, gpt: 0 |
| After merging duplicates | 4 |
| Agreed by both | 0 |
| Disputed | 0 (kept 0, dropped 0) |
| Dropped | 1 (Dependabot exclude-paths glob; low confidence, not confirmable from the code) |
| Published | 3 |
| Consensus reached | True |
| Review confidence | 45 |
Reviewed by PR re-review. Comment
/reviewto run it again.
Comment /review to run again
| inputs: | ||
| version: | ||
| description: Neovim release to install | ||
| default: 0.11.4 # keep in sync with the Neovim you run locally |
There was a problem hiding this comment.
The pinned Neovim version now lives here, but .github/agents/pr-reviewer.agent.md (line 28) still tells reviewers to find it in .github/workflows/ci.yml, which no longer has one. Point that line at .github/actions/setup-nvim/action.yml, or reviewers can't tell which Neovim API level to check against.
| env: | ||
| BRANCH: simonk/dev/plugin-update | ||
| BOT_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com | ||
| GH_TOKEN: ${{ github.token }} |
There was a problem hiding this comment.
Supply chain: the Update plugins step runs nvim, which loads your whole config, pulls the newest unreviewed commit of every plugin with :Lazy update, and runs their build steps (make for telescope-fzf-native and LuaSnip). This job has contents: write, pull-requests: write and actions: write. The token is exposed in two ways:
GH_TOKENhere is in the job-levelenv, sonvimand every build it spawns inherit it.actions/checkoutkeeps the token in the git config by default (persist-credentials: true).
A compromised or broken plugin could push to main (if branch protection allows it), edit workflows or start other workflows. The pull_request dry run has the same exposure for same-repo branches.
Suggested fix: split into two jobs.
update:permissions: contents: read,persist-credentials: false, noGH_TOKEN. It runs nvim, then uploadslazy-lock.jsonandpr-body.mdwithactions/upload-artifact.publish:needs: update,if: github.event_name != 'pull_request', with the write permissions. It downloads the artifact and does the commit, push,gh prandgh workflow runsteps. Neovim never runs here.
| git config user.email $env:BOT_EMAIL | ||
| git switch --quiet -C $env:BRANCH | ||
| git commit --quiet -m 'Update plugins' -- lazy-lock.json | ||
| git push --quiet --force origin "HEAD:refs/heads/$env:BRANCH" |
There was a problem hiding this comment.
The author check only runs when an open PR exists. If the branch is left behind after a PR is closed without merging, --force overwrites whatever is on it, including your own fix commits. A commit that lands between the check and the push is also overwritten.
Consider recording the remote SHA (git ls-remote origin refs/heads/$env:BRANCH), checking its authors even without a PR, and pushing with --force-with-lease=refs/heads/${env:BRANCH}:<sha>. Docs: (gitscm.com/redacted) Minor, since the instructions already say not to reuse the branch.
Dependabot can't update
lazy-lock.json(lazy.nvim isn't a supported ecosystem), so this splits dependency updates in two:.github/dependabot.yml: GitHub Actions only, monthly, one grouped PR. Skips*.lock.ymlso it doesn't edit the gh-aw files from Add an AI PR reviewer #10;gh aw upgraderefreshes those..github/workflows/plugin-update.yml: every Monday (or on demand) runs:Lazy update, commitslazy-lock.jsontosimonk/dev/plugin-update, and opens or refreshes an Update plugins PR with a compare link per plugin. PRs made withGITHUB_TOKENdon't trigger workflows, so it dispatchesci.ymlon the branch and the smoke test still runs on the new commits. It won't force-push over the branch once someone else has committed to it..github/actions/setup-nvim: the Neovim install / XDG isolation /makesteps fromci.yml, now shared by both workflows. The Neovim version lives here now.On this PR the updater does a dry run (no push, no PR) and puts the would-be PR body in the job summary.
Tested locally: the update script on a fresh copy changed 33 plugins with no errors, and the smoke test passes on the updated plugins.
Before the first scheduled run: turn on Settings → Actions → General → Allow GitHub Actions to create and approve pull requests, otherwise
gh pr createfails. It's off now.