From 986aa45f754aa27b7d1ecc190da20b7ac3de7b52 Mon Sep 17 00:00:00 2001 From: Andre Manoel Date: Mon, 13 Apr 2026 13:46:27 +0000 Subject: [PATCH 1/3] fix: restrict Dependabot pip updates to security-only The Dependabot config added in #517 included weekly version-bump PRs for all three pip packages. This would generate noisy PRs for routine dep updates we don't need. Set open-pull-requests-limit: 0 on the pip ecosystems so only CVE-triggered security updates open PRs. GitHub Actions weekly bumps are kept as-is to keep SHA pins current. --- .github/dependabot.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 82d1743aa..229ee0475 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -10,17 +10,20 @@ updates: directory: /packages/data-designer-config schedule: interval: weekly + open-pull-requests-limit: 0 commit-message: prefix: "chore" - package-ecosystem: pip directory: /packages/data-designer-engine schedule: interval: weekly + open-pull-requests-limit: 0 commit-message: prefix: "chore" - package-ecosystem: pip directory: /packages/data-designer schedule: interval: weekly + open-pull-requests-limit: 0 commit-message: prefix: "chore" From 4fede0c4fa2ebe055e1bdb90f16af908a06c1747 Mon Sep 17 00:00:00 2001 From: Andre Manoel Date: Mon, 13 Apr 2026 14:35:22 +0000 Subject: [PATCH 2/3] fix: group Dependabot Actions PRs and fix DCO allowlist - Add a Dependabot group to bundle all GitHub Actions updates into a single weekly PR instead of one per action - Fix DCO allowlist: dependabot -> dependabot[bot] to match the actual GitHub username (the old value never matched, but there were no Dependabot PRs before #517 to expose the bug) --- .github/dependabot.yml | 4 ++++ .github/workflows/dco-assistant.yml | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 229ee0475..37c88aed7 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,6 +4,10 @@ updates: directory: / schedule: interval: weekly + groups: + all-actions: + patterns: + - "*" commit-message: prefix: "ci" - package-ecosystem: pip diff --git a/.github/workflows/dco-assistant.yml b/.github/workflows/dco-assistant.yml index 2fa3c5769..6940616e5 100644 --- a/.github/workflows/dco-assistant.yml +++ b/.github/workflows/dco-assistant.yml @@ -35,7 +35,7 @@ jobs: path-to-signatures: "dco-signatures.json" path-to-document: 'https://github.com/NVIDIA-NeMo/DataDesigner/blob/main/DCO' branch: 'signatures' - allowlist: dependabot + allowlist: dependabot[bot] create-file-commit-message: "chore: create file to store dco signatures" signed-commit-message: "chore: $contributorName has signed the dco in #$pullRequestNo" custom-notsigned-prcomment: "Thank you for your submission! We ask that $you sign our [Developer Certificate of Origin](https://github.com/NVIDIA-NeMo/DataDesigner/blob/main/DCO) before we can accept your contribution. You can sign the DCO by adding a comment below using this text:" From 3dd06e78418d80f2e380fae37219d3f0bed6f541 Mon Sep 17 00:00:00 2001 From: Andre Manoel Date: Mon, 13 Apr 2026 14:56:46 +0000 Subject: [PATCH 3/3] fix: align DCO assistant if-condition with custom sign-off text The step's if-condition checked for the default sign-off text but custom-pr-sign-comment uses different wording. This meant the issue_comment trigger was always skipped - sign-offs only worked by accident when a subsequent push re-triggered the action via pull_request_target. --- .github/workflows/dco-assistant.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dco-assistant.yml b/.github/workflows/dco-assistant.yml index 6940616e5..dddb19bec 100644 --- a/.github/workflows/dco-assistant.yml +++ b/.github/workflows/dco-assistant.yml @@ -26,7 +26,7 @@ jobs: runs-on: ubuntu-latest steps: - name: "DCO Assistant" - if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the Contributor Agreement including DCO and I hereby sign the Contributor Agreement and DCO') || github.event_name == 'pull_request_target' + if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the DCO document and I hereby sign the DCO.') || github.event_name == 'pull_request_target' uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}