From 26bab775eb10c407716c76c8b61bb7875a2e4aa3 Mon Sep 17 00:00:00 2001 From: jkoniusz Date: Wed, 12 Aug 2026 13:50:34 +0200 Subject: [PATCH 1/2] cvs --- .../workflows/cleanup_dependabot_branches.yml | 32 ++++++++++++++++--- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/.github/workflows/cleanup_dependabot_branches.yml b/.github/workflows/cleanup_dependabot_branches.yml index 39935401731018..5c3fde2d2a232b 100644 --- a/.github/workflows/cleanup_dependabot_branches.yml +++ b/.github/workflows/cleanup_dependabot_branches.yml @@ -1,5 +1,18 @@ name: Cleanup stale dependabot branches on: + # Lets other openvinotoolkit repositories reuse this workflow instead of + # duplicating the job and the cleanup script. The run still happens against + # the calling repository's branches, with the calling repository's token. + workflow_call: + inputs: + dry_run: + description: 'Only log branches that would be deleted, do not delete them' + type: boolean + required: false + default: true + secrets: + DEPENDABOT_CLEANUP_TOKEN: + required: true workflow_dispatch: inputs: dry_run: @@ -26,6 +39,13 @@ jobs: uses: ababushk/checkout@dd591a6a2ac25618db4eda86e7e0d938f88cf01b # cherry_pick_retries timeout-minutes: 15 with: + # Inside a called workflow a bare checkout targets the calling + # repository, which does not contain the cleanup script, so the + # source of the script is pinned here. Runs of this repository's own + # workflow keep using the ref they were started from, so script + # changes can still be tested by dispatching from a branch. + repository: openvinotoolkit/openvino + ref: ${{ github.repository == 'openvinotoolkit/openvino' && github.ref || 'master' }} sparse-checkout: '.github/scripts/dependabot_cleanup' - name: Setup Python @@ -45,12 +65,16 @@ jobs: # repository with contents:write and pull-requests:read. That account is # a repository admin, a role the ruleset bypass list already covers. GITHUB_TOKEN: ${{ secrets.DEPENDABOT_CLEANUP_TOKEN }} - # Real deletions happen only on the weekly schedule, or on a manual run - # where the dry_run checkbox was explicitly unchecked. Every other case - # (manual run with the box checked, or any other trigger) stays a dry run. + # Real deletions happen only when dry_run is explicitly off: on the + # weekly schedule, where there are no inputs at all and the value is + # empty, on a manual run with the checkbox unchecked, and when a + # calling workflow passed false. Every other case, including an + # unrecognised value, stays a dry run. The comparison against the + # string is there because a boolean handed over by a calling workflow + # can arrive as a string rather than as a real boolean. # The " && 'false' || 'true'" shape is safe because both sides are # non-empty strings, so it never falls through to the wrong value. - DRY_RUN: ${{ (github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.dry_run == false)) && 'false' || 'true' }} + DRY_RUN: ${{ (!inputs.dry_run || inputs.dry_run == 'false') && 'false' || 'true' }} run: | python3 ${{ github.workspace }}/.github/scripts/dependabot_cleanup/cleanup_dependabot_branches.py \ --repository-name ${GITHUB_REPOSITORY} From 7b7f59fd01aea31e19c5b14b9ad4c2c19f2a7ead Mon Sep 17 00:00:00 2001 From: jkoniusz Date: Wed, 12 Aug 2026 15:18:17 +0200 Subject: [PATCH 2/2] cvs --- .../workflows/cleanup_dependabot_branches.yml | 29 +++++++++++-------- 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/.github/workflows/cleanup_dependabot_branches.yml b/.github/workflows/cleanup_dependabot_branches.yml index 5c3fde2d2a232b..009b34482133ad 100644 --- a/.github/workflows/cleanup_dependabot_branches.yml +++ b/.github/workflows/cleanup_dependabot_branches.yml @@ -40,10 +40,13 @@ jobs: timeout-minutes: 15 with: # Inside a called workflow a bare checkout targets the calling - # repository, which does not contain the cleanup script, so the - # source of the script is pinned here. Runs of this repository's own - # workflow keep using the ref they were started from, so script - # changes can still be tested by dispatching from a branch. + # repository, which does not contain the cleanup script, so the source + # of the script is pinned here. Runs of this repository's own workflow + # keep using the ref they were started from, so script changes can + # still be tested by dispatching from a branch. Callers always get the + # script from master: no context exposes the commit a reusable workflow + # was read from, so pinning this workflow with @ pins the workflow + # but not the script it runs. repository: openvinotoolkit/openvino ref: ${{ github.repository == 'openvinotoolkit/openvino' && github.ref || 'master' }} sparse-checkout: '.github/scripts/dependabot_cleanup' @@ -65,16 +68,18 @@ jobs: # repository with contents:write and pull-requests:read. That account is # a repository admin, a role the ruleset bypass list already covers. GITHUB_TOKEN: ${{ secrets.DEPENDABOT_CLEANUP_TOKEN }} - # Real deletions happen only when dry_run is explicitly off: on the - # weekly schedule, where there are no inputs at all and the value is - # empty, on a manual run with the checkbox unchecked, and when a - # calling workflow passed false. Every other case, including an - # unrecognised value, stays a dry run. The comparison against the - # string is there because a boolean handed over by a calling workflow - # can arrive as a string rather than as a real boolean. + # Deleting for real needs a dry_run that is off and a trigger allowed to + # delete, which means the weekly schedule or a manual dispatch. Anything + # else stays a dry run, including for callers, whose own event is what + # shows up here: a caller's cron and its manual runs can delete, a caller + # driven by a pull request or a push cannot. That check comes first + # because a trigger without inputs leaves dry_run empty, which must not + # be read as an explicit "off" outside the schedule. + # dry_run is compared against the string too: a boolean from a calling + # workflow can arrive as one. # The " && 'false' || 'true'" shape is safe because both sides are # non-empty strings, so it never falls through to the wrong value. - DRY_RUN: ${{ (!inputs.dry_run || inputs.dry_run == 'false') && 'false' || 'true' }} + DRY_RUN: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && (!inputs.dry_run || inputs.dry_run == 'false') && 'false' || 'true' }} run: | python3 ${{ github.workspace }}/.github/scripts/dependabot_cleanup/cleanup_dependabot_branches.py \ --repository-name ${GITHUB_REPOSITORY}