AW Dependabot PR review silently skips: migrate from workflow_run to /aw-dependabot-review slash command

[katriendg]

Summary

The AW Dependabot PR Review agentic workflow (.github/workflows/aw-dependabot-pr-review.md) silently skips on every run and never posts a review. It reports green while doing nothing, so the advisory Dependabot review has effectively been non-functional.

This issue tracks the fix: migrating the trigger from workflow_run to a maintainer-invoked /aw-dependabot-review slash command.

Root cause

The workflow was triggered by workflow_run after PR Validation completed on a dependabot/** branch. Under that posture, the triggering actor is dependabot[bot] (permission none). gh-aw's pre_activation role gate (check_membership) evaluates that actor against GH_AW_REQUIRED_ROLES: "admin,maintainer,write", finds no qualifying role, sets activated=false, and skips all downstream jobs — without failing. The result is a green run that produces no advisory.

A direct fix (adding a bots:/roles: allowlist under on:) was attempted but is blocked by a gh-aw compiler bug: bots:/roles: siblings alongside a workflow_run trigger break workflow_run branch validation. So the workflow_run posture is a dead end.

New approach: maintainer-invoked slash command

Switch the trigger to a slash command that a maintainer runs on demand:

on:
  slash_command:
    name: aw-dependabot-review
    events: [pull_request_comment]

A maintainer comments /aw-dependabot-review on a Dependabot PR to request the advisory review.

Why this fixes the root cause: with a slash command, gh-aw's role gate evaluates the commenter (a maintainer with write+), not dependabot[bot]. Activation passes, and the review runs. It also sidesteps the workflow_run compiler bug entirely.

Implementation notes

• Resolver rewrite. The slash command carries no workflow_run payload, so the resolver step now: reads the PR from context.payload.issue.number, hydrates via pulls.get, skips non-Dependabot/draft PRs (PR_DEPENDABOT_SKIP_REASON), and looks up the latest PR Validation run for the PR head SHA via actions.listWorkflowRunsForRepo to populate PR_VALIDATION_CONCLUSION / PR_VALIDATION_RUN_URL. The env-var contract consumed by the agent persona is unchanged.
• Permissions stay scoped: contents: read, pull-requests: read, actions: read (for the workflow-run lookup), checks: read.
• Concurrency keys on github.event.issue.number.
• Compiler. Recompile with the latest gh aw release (currently v0.77.5), which carries fixes we want.
• Dependabot rules. .github/dependabot.yml already contains the compiler-managed github/gh-aw-actions/* exclude + ignore rule, so no rule change is required. Note: a plain gh aw compile performs a destructive cosmetic reformat of the hand-curated dependabot.yml (strips rationale comments, alphabetizes keys, relocates version: 2) — that reformat must not be committed.
• Agent persona (.github/agents/dependabot-pr-reviewer.agent.md) is trigger-agnostic and needs no change.

Acceptance criteria

• aw-dependabot-pr-review.md uses the slash_command trigger named aw-dependabot-review.
• Commenting /aw-dependabot-review on a Dependabot PR (as a maintainer) activates the workflow and posts exactly one advisory review.
• Resolver populates PR_VALIDATION_CONCLUSION / PR_VALIDATION_RUN_URL from the head-SHA PR Validation lookup.
• Lock file recompiled with the latest gh aw release; no destructive dependabot.yml reformat is introduced.
• Advisory-only behavior preserved (APPROVE/COMMENT only, never REQUEST_CHANGES).

References

• Workflow source: .github/workflows/aw-dependabot-pr-review.md
• Agent persona: .github/agents/dependabot-pr-reviewer.agent.md
• gh-aw slash-command + dependabot manifest reference: https://githubnext.github.io/gh-aw/reference/triggers/ , https://githubnext.github.io/gh-aw/reference/dependabot/

[bindsi]

@katriendg do we really want to move it to slash command? We can also add the bot bots: ["dependabot[bot]"] frontmatter property to make it work like we did in hve-core repo...worth to think about it and align?

[katriendg]

@bindsi so the thing is (if I remember correctly), the current approach with the workflow_run trigger does not support the dependabot bot. The idea is to have the AW reviewer run after CI, and only when relevant (so not every single time we rebase), which was why I figured slash command was a relevant, controlled choice.

Let's align offline and comment back here, good idea.