feat: investigate Dependabot security alerts

.github/actions/setup-target/action.yml

@@ -0,0 +1,166 @@
+---
+name: Setup target repo
+description: >-
+  Parse target repo, create app token, checkout, read config, and install
+  Python. Shared by investigate, fix, and setup workflows.
+
+inputs:
+  target-repo:
+    description: 'Target repo (e.g. mozilla/fx-private-relay)'
+    required: true
+  app-id:
+    description: 'GitHub App ID for token creation'
+    required: true
+  private-key:
+    description: 'GitHub App private key'
+    required: true
+  blender-workspace:
+    description: 'Path to blender checkout (github.workspace)'
+    required: true
+  permission-contents:
+    description: 'Token permission for contents (omit to inherit all)'
+    default: ''
+  permission-pull-requests:
+    description: 'Token permission for pull-requests (omit to inherit all)'
+    default: ''
+  permission-vulnerability-alerts:
+    description: 'Token permission for vulnerability-alerts (omit to inherit all)'
+    default: ''
+  permission-security-events:
+    description: 'Token permission for security-events (omit to inherit all)'
+    default: ''
+  checkout-path:
+    description: 'Path to checkout target repo'
+    default: 'target'
+  checkout-submodules:
+    description: 'Submodules mode (false, true, or recursive)'
+    default: 'false'
+  checkout-persist-credentials:
+    description: 'Persist credentials after checkout'
+    default: 'false'
+  install-sandbox:
+    description: 'Install bubblewrap + socat'
+    default: 'false'
+  install-claude:
+    description: 'Install Claude Code CLI'
+    default: 'false'
+  install-blender-deps:
+    description: 'Install BLEnder Python dependencies'
+    default: 'false'
+
+outputs:
+  token:
+    description: 'GitHub App token for target repo'
+    value: ${{ steps.app-token.outputs.token }}
+  owner:
+    description: 'Target repo owner'
+    value: ${{ steps.parse.outputs.owner }}
+  name:
+    description: 'Target repo name'
+    value: ${{ steps.parse.outputs.name }}
+  node_version:
+    description: 'Node version from blender.yml'
+    value: ${{ steps.config.outputs.node_version }}
+  python_version:
+    description: 'Python version from blender.yml'
+    value: ${{ steps.config.outputs.python_version }}
+  install_command:
+    description: 'Install command from blender.yml'
+    value: ${{ steps.config.outputs.install_command }}
+  repo_name:
+    description: 'Display name from blender.yml'
+    value: ${{ steps.config.outputs.repo_name }}
+  dismiss_unaffected:
+    description: 'Whether to dismiss unaffected alerts'
+    value: ${{ steps.config.outputs.dismiss_unaffected }}
+  install_failed:
+    description: 'Whether the target dependency install failed'
+    value: ${{ steps.install-deps.outcome == 'failure' && 'true' || 'false' }}
+
+runs:
+  using: composite
+  steps:
+    - name: Parse target repo
+      id: parse
+      shell: bash
+      run: |
+        echo "owner=${TARGET_REPO%%/*}" >> "$GITHUB_OUTPUT"
+        echo "name=${TARGET_REPO##*/}" >> "$GITHUB_OUTPUT"
+      env:
+        TARGET_REPO: ${{ inputs.target-repo }}
+
+    - id: app-token
+      uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349  # v2
+      with:
+        app-id: ${{ inputs.app-id }}
+        private-key: ${{ inputs.private-key }}
+        owner: ${{ steps.parse.outputs.owner }}
+        repositories: ${{ steps.parse.outputs.name }}
+        permission-contents: ${{ inputs.permission-contents || '' }}
+        permission-pull-requests: ${{ inputs.permission-pull-requests || '' }}
+        permission-vulnerability-alerts: ${{ inputs.permission-vulnerability-alerts || '' }}
+        permission-security-events: ${{ inputs.permission-security-events || '' }}
+
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      with:
+        repository: ${{ inputs.target-repo }}
+        token: ${{ steps.app-token.outputs.token }}
+        path: ${{ inputs.checkout-path }}
+        submodules: ${{ inputs.checkout-submodules }}
+        persist-credentials: ${{ inputs.checkout-persist-credentials }}
+
+    - name: Read repo config
+      id: config
+      shell: bash
+      run: |
+        CONFIG_FILE="${CHECKOUT_PATH}/.blender/blender.yml"
+        if [ ! -f "$CONFIG_FILE" ]; then
+          echo "Error: No config found at $CONFIG_FILE"
+          exit 1
+        fi
+        {
+          echo "node_version=$(yq '.node_version // ""' "$CONFIG_FILE")"
+          echo "python_version=$(yq '.python_version // ""' "$CONFIG_FILE")"
+          echo "install_command=$(yq '.install_command // ""' "$CONFIG_FILE")"
+          echo "repo_name=$(yq '.repo_name // ""' "$CONFIG_FILE")"
+          echo "dismiss_unaffected=$(yq '.investigate.dismiss_unaffected // "false"' "$CONFIG_FILE")"
+        } >> "$GITHUB_OUTPUT"
+      env:
+        CHECKOUT_PATH: ${{ inputs.checkout-path }}
+
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
+      with:
+        python-version: ${{ steps.config.outputs.python_version || '3.11' }}
+        cache: pip
+
+    - name: Install BLEnder Python dependencies
+      if: inputs.install-blender-deps == 'true'
+      shell: bash
+      run: pip install -r scripts/requirements.txt
+      working-directory: ${{ inputs.blender-workspace }}
+
+    - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6
+      if: steps.config.outputs.node_version != ''
+      with:
+        node-version: ${{ steps.config.outputs.node_version }}
+
+    - name: Install target dependencies
+      id: install-deps
+      if: steps.config.outputs.install_command != ''
+      continue-on-error: true
+      shell: bash
+      working-directory: ${{ inputs.checkout-path }}
+      run: |
+        eval "$INSTALL_COMMAND" 2>&1 | tee /tmp/install-output.log
+      env:
+        INSTALL_COMMAND: ${{ steps.config.outputs.install_command }}
+
+    - name: Install sandbox dependencies
+      if: inputs.install-sandbox == 'true'
+      shell: bash
+      run: sudo apt-get install -y bubblewrap socat
+
+    - name: Install Claude Code
+      if: inputs.install-claude == 'true'
+      shell: bash
+      run: npm install -g @anthropic-ai/claude-code@stable

.github/workflows/fix-dependabot-pr.yml

@@ -36,47 +36,19 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Parse target repo
-        id: parse
-        run: |
-          echo "owner=${TARGET_REPO%%/*}" >> "$GITHUB_OUTPUT"
-          echo "name=${TARGET_REPO##*/}" >> "$GITHUB_OUTPUT"
-        env:
-          TARGET_REPO: ${{ inputs.target_repo }}
-
-      - id: app-token
-        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349  # v2
+      - name: Setup target repo
+        id: setup
+        uses: ./.github/actions/setup-target
         with:
+          target-repo: ${{ inputs.target_repo }}
           app-id: ${{ secrets.BLENDER_APP_ID }}
           private-key: ${{ secrets.BLENDER_APP_PRIVATE_KEY }}
-          owner: ${{ steps.parse.outputs.owner }}
-          repositories: ${{ steps.parse.outputs.name }}
+          blender-workspace: ${{ github.workspace }}
           permission-contents: write
           permission-pull-requests: write
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
-        with:
-          repository: ${{ inputs.target_repo }}
-          token: ${{ steps.app-token.outputs.token }}
-          path: target
-          submodules: ${{ inputs.submodules == 'true' && 'recursive' || 'false' }}
-          persist-credentials: false
-
-      - name: Read repo config
-        id: config
-        run: |
-          CONFIG_FILE="target/.blender/blender.yml"
-          if [ ! -f "$CONFIG_FILE" ]; then
-            echo "Error: No config found at $CONFIG_FILE"
-            echo "Run the setup workflow first to onboard this repo."
-            exit 1
-          fi
-          {
-            echo "node_version=$(yq '.node_version // ""' "$CONFIG_FILE")"
-            echo "python_version=$(yq '.python_version // ""' "$CONFIG_FILE")"
-            echo "install_command=$(yq '.install_command // ""' "$CONFIG_FILE")"
-            echo "repo_name=$(yq '.repo_name // ""' "$CONFIG_FILE")"
-          } >> "$GITHUB_OUTPUT"
+          checkout-submodules: ${{ inputs.submodules == 'true' && 'recursive' || 'false' }}
+          install-sandbox: 'true'
+          install-claude: 'true'
 
       - name: Save BLEnder config from default branch
         run: cp -r target/.blender /tmp/blender-config
@@ -86,49 +58,22 @@ jobs:
         run: gh pr checkout "$PR_NUMBER"
         env:
           PR_NUMBER: ${{ inputs.pr_number }}
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ steps.setup.outputs.token }}
 
       - name: Restore BLEnder config
         run: cp -r /tmp/blender-config/. target/.blender/
 
-      # --- Conditional setup ---
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
-        with:
-          python-version: ${{ steps.config.outputs.python_version || '3.11' }}
-          cache: pip
-
-      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f  # v6
-        if: steps.config.outputs.node_version != ''
-        with:
-          node-version: ${{ steps.config.outputs.node_version }}
-
-      - name: Install dependencies
-        id: install
-        if: steps.config.outputs.install_command != ''
-        continue-on-error: true
-        working-directory: target
-        run: |
-          eval "$INSTALL_COMMAND" 2>&1 | tee /tmp/install-output.log
-        env:
-          INSTALL_COMMAND: ${{ steps.config.outputs.install_command }}
-
       # --- BLEnder fix ---
-      - name: Install sandbox dependencies
-        run: sudo apt-get install -y bubblewrap socat
-
-      - name: Install Claude Code
-        run: npm install -g @anthropic-ai/claude-code@stable
-
       - name: Gather PR context
         id: gather
         working-directory: target
         run: ${{ github.workspace }}/scripts/gather-context.sh
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ steps.setup.outputs.token }}
           PR_NUMBER: ${{ inputs.pr_number }}
           REPO: ${{ inputs.target_repo }}
           PROMPT_TEMPLATE: .blender/fix-dependabot-prompt.md
-          INSTALL_FAILED: ${{ steps.install.outcome == 'failure' && 'true' || 'false' }}
+          INSTALL_FAILED: ${{ steps.setup.outputs.install_failed }}
           INSTALL_LOG_FILE: /tmp/install-output.log
 
       - name: Upload gathered context
@@ -153,7 +98,7 @@ jobs:
           )
           gh pr comment "$PR_NUMBER" --repo "$REPO" --body "$BODY"
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ steps.setup.outputs.token }}
           PR_NUMBER: ${{ inputs.pr_number }}
           REPO: ${{ inputs.target_repo }}
 
@@ -162,7 +107,7 @@ jobs:
         run: |
           gh pr comment "$PR_NUMBER" --body "BLEnder picked up this PR. [Workflow run](${RUN_URL})"
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ steps.setup.outputs.token }}
           PR_NUMBER: ${{ inputs.pr_number }}
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
 
@@ -172,7 +117,7 @@ jobs:
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           REPO: ${{ inputs.target_repo }}
-          REPO_NAME: ${{ steps.config.outputs.repo_name }}
+          REPO_NAME: ${{ steps.setup.outputs.repo_name }}
           BLENDER_DIR: ${{ github.workspace }}
           CLAUDE_VERBOSE: ${{ inputs.verbose }}
 
@@ -183,7 +128,7 @@ jobs:
         working-directory: target
         run: ${{ github.workspace }}/scripts/commit.sh
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ steps.setup.outputs.token }}
           REPO: ${{ inputs.target_repo }}
 
       - name: Parse PR title
@@ -242,7 +187,7 @@ jobs:
           gh pr comment "$PR_NUMBER" \
             --body "BLEnder could not fix this PR automatically. [Workflow run](${RUN_URL})"
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ steps.setup.outputs.token }}
           PR_NUMBER: ${{ inputs.pr_number }}
           RUN_URL: >-
             ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}