fix(ci): stop false-red revert-oracle failures on Dependabot updates (#4084)

* fix(ci): exempt dependency-only Dependabot PRs from revert oracle

* fix(ci): cover configured Docker dependency updates

* fix(ci): bind dependency manifests to configured workspaces

Author: louistrue

.github/workflows/test.yml

@@ -460,6 +460,8 @@ jobs:
           name: build-output
           path: packages
       - name: Prove the changed tests observe the production change
+        env:
+          PR_AUTHOR_LOGIN: ${{ github.event.pull_request.user.login }}
         run: node scripts/check-test-revert-oracle.mjs --base origin/main --ci --json
 
   typecheck:

scripts/check-test-revert-oracle.mjs

@@ -89,6 +89,7 @@ import {
   UNOBSERVED,
   SURGICAL_ADVICE,
 } from './lib/revert-oracle.mjs';
+import { isDependabotDependencyOnly } from './lib/revert-oracle-dependabot.mjs';
 import { cargoTestOwner } from './lib/revert-oracle-cargo.mjs';
 import { ciExitCode } from './lib/revert-oracle-ci.mjs';
 
@@ -300,6 +301,14 @@ const mergeBase = gitOrDie(['merge-base', baseSha, headSha]).trim();
 const entries = parseNameStatus(gitOrDie(['diff', '--name-status', `${mergeBase}`, headSha]));
 if (entries.length === 0) die(EXIT_NOTHING_CHECKED, 'the diff is empty; nothing to check.');
 
+if (opts.ci && isDependabotDependencyOnly(process.env.PR_AUTHOR_LOGIN, entries)) {
+  console.log(
+    '  NOT APPLICABLE: Dependabot changed dependency manifests/lockfiles only; ' +
+      'the normal build and test lanes provide the compatibility verdict.',
+  );
+  process.exit(0);
+}
+
 const { production, test: testEntries, ignored, warnings } = classifyDiff(entries);
 for (const w of warnings) console.log(`  WARNING: ${w}`);
 

scripts/lib/revert-oracle-dependabot.mjs

@@ -0,0 +1,34 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+const NPM_MANIFEST_RE = /^(?:package\.json|(?:packages|apps|examples)\/[^/]+\/package\.json)$/;
+const CARGO_MANIFESTS = new Set([
+  'Cargo.toml',
+  'rust/core/Cargo.toml',
+  'rust/geometry/Cargo.toml',
+  'rust/processing/Cargo.toml',
+  'rust/clash/Cargo.toml',
+  'rust/ffi/Cargo.toml',
+  'rust/export/Cargo.toml',
+  'rust/wasm-bindings/Cargo.toml',
+  'apps/server/Cargo.toml',
+]);
+const LOCKFILES = new Set(['pnpm-lock.yaml', 'package-lock.json', 'yarn.lock', 'Cargo.lock']);
+const DOCKERFILES = new Set([
+  'apps/server/Dockerfile',
+  'packages/collab-server/Dockerfile',
+  'tools/ifcopenshell_reference/Dockerfile',
+]);
+
+/**
+ * The normal build and test lanes are the compatibility oracle for a dependency
+ * bump. Reverting its manifest without its ignored lockfile is not coherent.
+ * One non-dependency path restores the normal changed-test requirement.
+ */
+export function isDependabotDependencyOnly(login, entries) {
+  if (login !== 'dependabot[bot]' || entries.length === 0) return false;
+  return entries.every(({ path }) =>
+    NPM_MANIFEST_RE.test(path) || CARGO_MANIFESTS.has(path) || LOCKFILES.has(path) || DOCKERFILES.has(path)
+  );
+}

scripts/lib/revert-oracle-dependabot.test.mjs

@@ -0,0 +1,44 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { isDependabotDependencyOnly } from './revert-oracle-dependabot.mjs';
+
+const entries = (...paths) => paths.map((path) => ({ status: 'M', path }));
+
+test('#4080: Dependabot-only dependency manifests and lockfiles use the normal test lanes', () => {
+  assert.equal(
+    isDependabotDependencyOnly(
+      'dependabot[bot]',
+      entries(
+        'package.json',
+        'packages/viewer/package.json',
+        'rust/geometry/Cargo.toml',
+        'pnpm-lock.yaml',
+        'Cargo.lock',
+        'apps/server/Dockerfile',
+        'packages/collab-server/Dockerfile',
+        'tools/ifcopenshell_reference/Dockerfile',
+      ),
+    ),
+    true,
+  );
+});
+
+test('#4080: the exception cannot swallow authored or mixed changes', () => {
+  assert.equal(isDependabotDependencyOnly('BIMvoice', entries('package.json')), false);
+  assert.equal(isDependabotDependencyOnly('app/dependabot', entries('package.json')), false);
+  assert.equal(isDependabotDependencyOnly('dependabot[bot]', []), false);
+  assert.equal(
+    isDependabotDependencyOnly('dependabot[bot]', entries('package.json', 'packages/viewer/src/index.ts')),
+    false,
+  );
+  assert.equal(isDependabotDependencyOnly('dependabot[bot]', entries('packages/viewer/not-package.json')), false);
+  assert.equal(isDependabotDependencyOnly('dependabot[bot]', entries('fixtures/package.json')), false);
+  assert.equal(isDependabotDependencyOnly('dependabot[bot]', entries('packages/viewer/fixture/package.json')), false);
+  assert.equal(isDependabotDependencyOnly('dependabot[bot]', entries('rust/python/Cargo.toml')), false);
+  assert.equal(isDependabotDependencyOnly('dependabot[bot]', entries('rust/csg-thread-bench/Cargo.toml')), false);
+  assert.equal(isDependabotDependencyOnly('dependabot[bot]', entries('apps/viewer/Dockerfile')), false);
+});