Add configurable classification labels to dependency review workflow by Copilot · Pull Request #624 · elastic/ai-github-actions

Copilot · 2026-03-09T12:24:16Z

Summary

This PR makes dependency-review labeling configurable instead of hardcoded.

What changed

Added a new classification-labels input to the dependency review reusable workflow.
Replaced hardcoded label allowlisting with a pre-sanitize step that filters add_labels operations to only labels from classification-labels.
Updated Step 4 of the agent prompt to parse and use classification-labels dynamically, and to skip labeling when the input is empty.
Updated usage docs and examples to show how to configure classification-labels and define label semantics via additional-instructions.
Recompiled generated workflow artifacts and included the deny-all fix for empty classification-labels (all add_labels ops are removed when no labels are configured).

Impact

Repositories can define their own dependency-review classification labels (for example, needs-human-review, higher-risk, merge-ready).
Label application is now explicitly caller-controlled and safe by default when no labels are configured.

The body of this PR is automatically managed by the Trigger Update PR Body workflow.

…workflow Co-authored-by: fr4nc1sc0-r4m0n <215478872+fr4nc1sc0-r4m0n@users.noreply.github.com>

fr4nc1sc0-r4m0n

LGTM

coderabbitai · 2026-03-09T13:10:16Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f99a935f-b527-4a1b-88a4-4d23e97e1bc1

📥 Commits

Reviewing files that changed from the base of the PR and between 4cde7a2 and b48635b.

📒 Files selected for processing (2)

.github/workflows/trigger-dependency-review.yml
gh-agent-workflows/dependency-review/example.yml

📝 Walkthrough

Walkthrough

Replaces a hard-coded two-label labeling flow in the dependency-review workflow with a configurable comma-separated input named classification-labels. Adds a pre-sanitize step that reads classification-labels, normalizes it to an allowlist, and filters agent add_labels outputs to only items whose labels are in that allowlist (dropping items with no remaining labels). Removes explicit allowed-labels from the add_labels tool and safe-outputs handler, updates templates/prompts to propagate the new input, and adjusts documentation and examples to reflect the allowlist-driven behavior and the skip-if-empty semantics.

Possibly related PRs

Add dependency-review workflow for Dependabot/Renovate PR analysis #429: Modifies the dependency-review labeling flow; this PR builds on that work by introducing classification-labels parsing and pre-sanitization.
add mention-in-issue-by-id #582: Applies the same allowlist-driven labeling changes (adds classification-labels input, pre-sanitize step, and removes explicit safe-outputs allowed-labels) to a related workflow.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR successfully adds oblt-aw/ai/merge-ready as an allowed label across all required workflow configurations and documentation.
Out of Scope Changes check	✅ Passed	All changes are scoped to adding the new label to dependency review workflow; no unrelated modifications detected.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch copilot/add-safe-output-label

🛠️ Update Documentation: Commit on current branch
🛠️ Update Documentation: Create PR

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-03-09T13:14:39Z

.github/workflows/gh-aw-dependency-review.md

  - The updated dependency is used only in workflows triggered by push-to-main, release, schedule, or workflow_dispatch (cannot be validated in PR context)

-Only apply `needs-human-review` and `higher-risk` labels.
+- **`oblt-aw/ai/merge-ready`**: Apply when:


oblt-aw/ai/merge-ready is defined as "safe to merge without human review," but the workflow only adds labels and never removes existing ones. On reruns, a PR can retain a prior needs-human-review/higher-risk label and also receive oblt-aw/ai/merge-ready, which creates contradictory automation signals.

Please make oblt-aw/ai/merge-ready explicitly mutually exclusive (e.g., only apply it when neither risk label is present, or remove stale risk labels before adding it).

strawgate · 2026-03-09T16:15:08Z

@copilot we want the workflow to stay generic so we'll want to take a workflow input or allowed labels and then we'll want to apply them or not similar to our pr labeler, we'll also need to add the relevant instructions to the prompt

…of hardcoding label Co-authored-by: strawgate <6384545+strawgate@users.noreply.github.com>

Copilot · 2026-03-09T16:24:20Z

@copilot we want the workflow to stay generic so we'll want to take a workflow input or allowed labels and then we'll want to apply them or not similar to our pr labeler, we'll also need to add the re...

Done in commit a9edd8a. Instead of hardcoding oblt-aw/ai/merge-ready, the workflow now accepts a merge-ready-label input (optional, default ""). Following the same pattern as pr-labeler, a pre-sanitize step filters add_labels operations to only allow needs-human-review, higher-risk, and whatever is passed via merge-ready-label. The prompt instructions in Step 4 also conditionally reference the input when set. To use: merge-ready-label: oblt-aw/ai/merge-ready.

strawgate · 2026-03-09T16:32:39Z

@copilot "add-labels— applyneeds-human-revieworhigher-riskwhen issues are detected; apply the configuredmerge-ready-label` (if set) when the PR is safe to merge (max 3)"

We don't know that we can apply those other two labels.

Perhaps we need to change this into an allowed list of labels like pr labeler and have the label plus its description written to disk maybe and then read by the agent? And then if the caller wants to provide additional instructions they can

…ve all hardcoded labels Co-authored-by: strawgate <6384545+strawgate@users.noreply.github.com>

Copilot · 2026-03-09T16:41:42Z

@copilot "add-labels— applyneeds-human-revieworhigher-riskwhen issues are detected; apply the configuredmerge-ready-label` (if set) when the PR is safe to merge (max 3)...

Done in commit b921b78. Replaced merge-ready-label with a classification-labels input (comma-separated, same pattern as pr-labeler) — no labels are hardcoded anymore. The pre-sanitize step now enforces only whatever is passed via classification-labels; if it's empty, no labels can be applied. Callers define what each label means via additional-instructions. Example in example.yml shows how to configure it.

strawgate · 2026-03-09T17:13:20Z

@copilot what do we call it in the pr labeler? I'm wondering if we just call the input line "allowed-labels" or just "labels" classification labels seems weird

Copilot · 2026-03-09T17:14:05Z

@copilot what do we call it in the pr labeler? I'm wondering if we just call the input line "allowed-labels" or just "labels" classification labels seems weird

The pr-labeler workflow uses classification-labels. I kept the same name here for consistency, but happy to rename to allowed-labels or labels if you prefer — just say the word and I'll update all the references.

strawgate · 2026-03-09T17:57:53Z

@copilot fix dirty lock files

Co-authored-by: strawgate <6384545+strawgate@users.noreply.github.com>

Copilot · 2026-03-09T18:00:26Z

@copilot fix dirty lock files

Fixed in ce83bd8 — recompiled the workflows to regenerate the lock and trigger files.

github-actions · 2026-03-09T18:05:06Z

.github/workflows/gh-aw-dependency-review.md

+              .map((s) => s.trim())
+              .filter(Boolean)
+          );
+          if (allowed.size === 0) {


The empty-allowlist path currently fails open: when classification-labels is unset, this step returns early and leaves any add_labels operation untouched, while the safe-outputs config no longer enforces an allowed list. In that state, a model output containing arbitrary existing repo labels can still be applied, which conflicts with the stated contract (If empty, no labels are applied).

Please fail closed when allowed.size === 0 (e.g., strip all add_labels entries before processing) or reintroduce an allowlist constraint derived from classification-labels in the handler config.

strawgate · 2026-03-09T18:06:48Z

@copilot please address PR feedback

Co-authored-by: strawgate <6384545+strawgate@users.noreply.github.com>

Copilot · 2026-03-09T18:09:56Z

@copilot please address PR feedback

Fixed in 0894e8d — addressed the CodeRabbit/github-actions review feedback: when classification-labels is empty, the pre-sanitize step now strips all add_labels operations (deny-all) instead of returning early and leaving them intact.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/gh-aw-dependency-review.md:
- Line 84: Step fixes inconsistent version pin for the GitHub Action: change the
usage of actions/github-script@v7 to actions/github-script@v8 to match other
steps; locate the line using "uses: actions/github-script@v7" and update the tag
to "@v8" so all github-script invocations are consistent across the workflow.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e46b7524-4351-4ef8-9340-f6e9e212580f

📥 Commits

Reviewing files that changed from the base of the PR and between 95b1f1c and 4cde7a2.

📒 Files selected for processing (3)

.github/workflows/gh-aw-dependency-review.lock.yml
.github/workflows/gh-aw-dependency-review.md
.github/workflows/trigger-dependency-review.yml

✅ Files skipped from review due to trivial changes (1)

.github/workflows/trigger-dependency-review.yml

coderabbitai · 2026-03-09T19:04:32Z

.github/workflows/gh-aw-dependency-review.md

-      - "higher-risk"
+  steps:
+    - name: Pre-sanitize labels from input allowlist
+      uses: actions/github-script@v7


⚠️ Potential issue | 🟡 Minor

Version inconsistency: @v7 vs @v8 used elsewhere.

This step pins to github-script@v7 while all other github-script usages in the workflow compile to v8. Consider updating to @v8 for consistency.

Suggested fix

- uses: actions/github-script@v7 + uses: actions/github-script@v8

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

uses: actions/github-script@v7

uses: actions/github-script@v8

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed. In @.github/workflows/gh-aw-dependency-review.md at line 84, Step fixes inconsistent version pin for the GitHub Action: change the usage of actions/github-script@v7 to actions/github-script@v8 to match other steps; locate the line using "uses: actions/github-script@v7" and update the tag to "@v8" so all github-script invocations are consistent across the workflow.

Initial plan

1a13545

Copilot AI assigned Copilot and fr4nc1sc0-r4m0n Mar 9, 2026

Copilot started work on behalf of fr4nc1sc0-r4m0n March 9, 2026 12:24 View session

Add oblt-aw/ai/merge-ready as safe output label in dependency review …

fe8cf48

…workflow Co-authored-by: fr4nc1sc0-r4m0n <215478872+fr4nc1sc0-r4m0n@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add new label as safe output in dependency review workflow~~ Add oblt-aw/ai/merge-ready as allowed label in dependency review workflow Mar 9, 2026

Copilot finished work on behalf of fr4nc1sc0-r4m0n March 9, 2026 12:33

fr4nc1sc0-r4m0n approved these changes Mar 9, 2026

View reviewed changes

fr4nc1sc0-r4m0n marked this pull request as ready for review March 9, 2026 13:07

This comment was marked as resolved.

Sign in to view

github-actions bot added the small_boom Small PR blast radius; usually low human-review need label Mar 9, 2026

github-actions bot reviewed Mar 9, 2026

View reviewed changes

Copilot started work on behalf of strawgate March 9, 2026 16:15 View session

Refactor: add merge-ready-label input with pre-sanitize step instead …

a9edd8a

…of hardcoding label Co-authored-by: strawgate <6384545+strawgate@users.noreply.github.com>

Copilot AI changed the title ~~Add oblt-aw/ai/merge-ready as allowed label in dependency review workflow~~ Add configurable merge-ready label support to dependency review workflow Mar 9, 2026

Copilot finished work on behalf of strawgate March 9, 2026 16:25

Copilot started work on behalf of strawgate March 9, 2026 16:32 View session

Refactor: replace merge-ready-label with classification-labels - remo…

b921b78

…ve all hardcoded labels Co-authored-by: strawgate <6384545+strawgate@users.noreply.github.com>

Copilot AI changed the title ~~Add configurable merge-ready label support to dependency review workflow~~ Add configurable classification labels to dependency review workflow Mar 9, 2026

Copilot finished work on behalf of strawgate March 9, 2026 16:42

Copilot started work on behalf of strawgate March 9, 2026 17:13 View session

Copilot finished work on behalf of strawgate March 9, 2026 17:14

Merge branch 'main' into copilot/add-safe-output-label

95b1f1c

Copilot started work on behalf of strawgate March 9, 2026 17:58 View session

Fix dirty lock and trigger files by recompiling workflows

ce83bd8

Co-authored-by: strawgate <6384545+strawgate@users.noreply.github.com>

Copilot finished work on behalf of strawgate March 9, 2026 18:00

This comment was marked as resolved.

Sign in to view

github-actions bot reviewed Mar 9, 2026

View reviewed changes

Copilot started work on behalf of strawgate March 9, 2026 18:06 View session

Fix empty classification-labels to deny-all instead of skip

0894e8d

Co-authored-by: strawgate <6384545+strawgate@users.noreply.github.com>

Copilot finished work on behalf of strawgate March 9, 2026 18:10

Merge branch 'main' into copilot/add-safe-output-label

4cde7a2

coderabbitai bot reviewed Mar 9, 2026

View reviewed changes

github-actions bot added medium_boom Medium PR blast radius; likely benefits from human review and removed small_boom Small PR blast radius; usually low human-review need labels Mar 9, 2026

Update workflows

b48635b

github-actions bot mentioned this pull request Mar 9, 2026

[aw] No-Op Runs #448

Open

github-actions bot approved these changes Mar 9, 2026

View reviewed changes

strawgate merged commit 69855be into main Mar 9, 2026
22 checks passed

strawgate deleted the copilot/add-safe-output-label branch March 9, 2026 19:26

coderabbitai bot mentioned this pull request Mar 9, 2026

Switch to latest build #643

Merged

	uses: actions/github-script@v7
	uses: actions/github-script@v8

Conversation

Copilot AI commented Mar 9, 2026 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What changed

Impact

Uh oh!

fr4nc1sc0-r4m0n left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Possibly related PRs

Uh oh!

This comment was marked as resolved.

Uh oh!

github-actions bot Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

strawgate commented Mar 9, 2026

Uh oh!

Copilot AI commented Mar 9, 2026

Uh oh!

strawgate commented Mar 9, 2026

Uh oh!

Copilot AI commented Mar 9, 2026

Uh oh!

strawgate commented Mar 9, 2026

Uh oh!

Copilot AI commented Mar 9, 2026

Uh oh!

strawgate commented Mar 9, 2026

Uh oh!

Copilot AI commented Mar 9, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

github-actions bot Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

strawgate commented Mar 9, 2026

Uh oh!

Copilot AI commented Mar 9, 2026

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Mar 9, 2026 •

edited by github-actions bot

Loading

coderabbitai bot commented Mar 9, 2026 •

edited

Loading