Improve project picking logic so it handles Milestone and Release Candidates when triaging dependabot PRs

Author: ryanjbaxter

.github/actions/dependabot-scan/action.yml

@@ -70,8 +70,15 @@ runs:
       run: |
         node - << 'JSEOF'
         const fs = require('fs');
+        const path = require('path');
         const { execFileSync } = require('child_process');
 
+        // The milestone/board pre-release rule, shared with dependabot-triage.yml.
+        // GITHUB_ACTION_PATH is this action's own directory, so the relative path holds
+        // wherever the caller checked the repository out.
+        const { best } = require(
+          path.join(process.env.GITHUB_ACTION_PATH, '..', '..', 'scripts', 'prerelease-rank.js'));
+
         const REPO = process.env.REPO;
         const PROJECT = process.env.PROJECT;
         const TYPE = process.env.TYPE;
@@ -341,23 +348,33 @@ runs:
           return version;
         };
 
-        // Existing milestone titles, fetched once and reused for every PR in this repo.
+        // Open milestone titles, fetched once and reused for every PR in this repo.
         let milestoneTitles = null;
-        const milestoneExists = title => {
+        const openMilestones = () => {
           if (milestoneTitles === null) {
             // --paginate, with --slurp instead of --jq because gh refuses both together:
             // a repository past a hundred open milestones would otherwise lose the newest
             // ones, and those are the only ones this ever looks for.
             const r = gh(['api', '--paginate', '--slurp',
               `repos/${REPO}/milestones?state=open&per_page=100`]);
             milestoneTitles = r.ok
-              ? new Set(parseJson(r.out, []).flat().map(m => m.title))
-              : new Set();
+              ? parseJson(r.out, []).flat().map(m => m.title)
+              : [];
             if (!r.ok) warnings.push(`could not list milestones: ${r.err}`);
           }
-          return milestoneTitles.has(title);
+          return milestoneTitles;
         };
 
+        // The branch version gives the train's GA number (5.1.0), but a train ships
+        // milestones first, so the milestone that actually exists is 5.1.0-M1, then -M2,
+        // then -RC1. Matching the GA title literally means every PR against a freshly
+        // branched train is reported as "milestone 5.1.0 does not exist" until GA - which
+        // is most of the train's life, and is exactly what happened when 2026.0.0 opened.
+        //
+        // Only open milestones are considered, so a shipped milestone is never chosen; of
+        // what remains the furthest along wins, which is the one being worked toward.
+        const resolveMilestone = base => best(openMilestones(), base);
+
         const scanned = prs.map(pr => {
           const checks = (pr.statusCheckRollup || []).map(normalizeCheck);
           const failing = checks.filter(c => FAILING.has(c.state));
@@ -398,11 +415,15 @@ runs:
               milestoneState = 'unresolved';
               projectState = 'unresolved';
             } else {
-              expectedMilestone = version.replace(/-SNAPSHOT$/, '');
+              // Fall back to the bare GA title when nothing matches, so a 'missing'
+              // verdict still names the version it was looking for.
+              const milestoneBase = version.replace(/-SNAPSHOT$/, '');
+              const resolved = resolveMilestone(milestoneBase);
+              expectedMilestone = resolved || milestoneBase;
               const current = pr.milestone?.title || null;
               if (current === expectedMilestone) milestoneState = 'set';
               else if (current) milestoneState = 'mismatch';
-              else if (!milestoneExists(expectedMilestone)) milestoneState = 'missing';
+              else if (!resolved) milestoneState = 'missing';
               else milestoneState = 'unset';
 
               // Boards are OSS-only by design; commercial PRs get a milestone alone.

.github/scripts/prerelease-rank.js

@@ -0,0 +1,47 @@
+'use strict';
+
+// A release train ships milestones and release candidates before GA, and the GitHub
+// artifacts named after it follow suit. The 2026.0.0 train's project board and its
+// per-repo milestones are titled 2026.0.0-M1, then -M2, then -RC1, and only finally
+// 2026.0.0 itself.
+//
+// The releaser config only ever names the GA version, so anything matching a train to a
+// board or a milestone has to treat that version as a base to match against rather than a
+// literal title - otherwise every PR against a freshly branched train goes unfiled for
+// most of the train's life.
+//
+// Shared by the dependabot-scan action (milestones) and dependabot-triage.yml (boards).
+// It lives here rather than inline in each because those two started as copies of one
+// script, drifted, and a fix to one silently left the other broken for a week.
+
+// Anchored at both ends: 2026.0.0-SNAPSHOT, 2026.0.01 and 2026.0.0-M1-extra are not
+// pre-releases of 2026.0.0.
+const PRERELEASE = /^-(M|RC)(\d+)$/;
+
+// Is `title` the base itself or one of its pre-releases, and how far along? null when
+// unrelated. Ordered later-wins: GA > RC<n> > M<n>, higher <n> beating lower.
+const rank = (title, base) => {
+  if (title === base) return [2, 0];
+  if (!title.startsWith(base)) return null;
+  const m = title.slice(base.length).match(PRERELEASE);
+  if (!m) return null;
+  return [m[1] === 'RC' ? 1 : 0, Number(m[2])];
+};
+
+// Comparator putting the furthest-along entry first. Entries need a `rank` property.
+// Numeric throughout, so M10 sorts above M9 rather than below it as a string would.
+const byRankDesc = (a, b) => (b.rank[0] - a.rank[0]) || (b.rank[1] - a.rank[1]);
+
+// The furthest-along title in `titles` that belongs to `base`, or null when none does.
+const best = (titles, base) => {
+  const candidates = [];
+  for (const title of titles) {
+    const r = rank(title, base);
+    if (r) candidates.push({ title, rank: r });
+  }
+  if (!candidates.length) return null;
+  candidates.sort(byRankDesc);
+  return candidates[0].title;
+};
+
+module.exports = { rank, byRankDesc, best };

.github/workflows/README-dependabot-report.md

@@ -100,10 +100,20 @@ workflow has something to act on and the report can flag gaps. PRs on
 they belong to no release train and need neither a milestone nor a board:
 
 - **Milestone** — the base branch's project version with `-SNAPSHOT` stripped (the same
-  string [`post-release.yml`](post-release.yml) creates milestones with). Reported as
-  `set`, `unset` (exists but not applied), `mismatch` (a different one is applied — never
+  string [`post-release.yml`](post-release.yml) creates milestones with), resolved against
+  the repository's **open** milestones by the pre-release rule below. Reported as `set`,
+  `unset` (exists but not applied), `mismatch` (a different one is applied — never
   overwritten, only reported), or `missing` (no such milestone exists, which is the warning
   the design calls for).
+
+  A train ships milestones before GA, so the milestone that exists while `main` is at
+  `5.1.0-SNAPSHOT` is `5.1.0-M1`, not `5.1.0`. Matching `5.1.0` literally reported *every*
+  PR on a freshly branched train as `missing`; the base is now matched against `5.1.0-M1`,
+  `-M2`, `-RC1` and finally `5.1.0` itself, furthest-along first. Only open milestones are
+  candidates, so a shipped one is never chosen. The shared rule lives in
+  [`.github/scripts/prerelease-rank.js`](../scripts/prerelease-rank.js) — triage applies
+  the same rule to project boards, see
+  [Picking the board](README-dependabot-triage.md#picking-the-board).
 - **Project** — OSS only, resolved as below. Commercial PRs get a milestone and no board.
 
 ### Project resolution

.github/workflows/README-dependabot-triage.md

@@ -64,6 +64,12 @@ So the resolved train is treated as a **base**, and any board titled `<base>`,
 `<base>-M<n>` or `<base>-RC<n>` is a candidate. The match is anchored at both ends —
 `2026.0.0-SNAPSHOT`, `2026.0.01` and `2026.0.0-M1-extra` are not candidates for `2026.0.0`.
 
+The rule lives in [`.github/scripts/prerelease-rank.js`](../scripts/prerelease-rank.js)
+rather than inline here, because the scan action needs the identical rule for **milestones**
+— `5.1.0-M1` exists while `5.1.0` does not, in the same way and for the same reason. Two
+inline copies of one script is what left triage broken for a week when only the report's
+copy was fixed.
+
 Candidates are ranked:
 
 1. **Open before closed.** A milestone's board is closed once it ships, and filing into a
@@ -123,7 +129,9 @@ this one not in the list?" rather than leaving it out:
 | `conflicts with the base branch` | Needs a rebase — see [Rebase idempotency](#rebase-idempotency) |
 | `all checks pass but GitHub reports BLOCKED` | Branch protection, usually a required review |
 | `GitHub has not resolved mergeability yet` | Transient; resolves on a later run |
-| `not filed yet - waiting on milestone and project` | Triage has not finished filing it |
+| `not filed yet - waiting on milestone 5.0.4, expected 5.1.0-M1 …` | The PR carries the **previous** train's milestone. Triage never overwrites a mismatched milestone, so this needs a human — the reason names both so the row does not read as "has no milestone" |
+| `not filed yet - waiting on milestone 5.1.0-M1 not set` | No milestone yet; triage sets it on this run or the next |
+| `not filed yet - waiting on project` | Triage has not finished filing it |
 | `no board titled 2026.0.0 or 2026.0.0-M*/-RC*` | The train has no board at all yet |
 | `only board for 2026.0.0 is 2026.0.0-M2, which is closed` | The next milestone's board has not been opened — see [Picking the board](#picking-the-board) |
 | `maven is never auto-merged` | Policy — **dry runs only** |

.github/workflows/dependabot-triage.yml

@@ -204,8 +204,15 @@ jobs:
         run: |
           node - << 'JSEOF'
           const fs = require('fs');
+          const path = require('path');
           const { execFileSync } = require('child_process');
 
+          // The milestone/board pre-release rule, shared with the dependabot-scan action,
+          // which applies it to milestones. This job checks the repository out, so the
+          // module sits under the workspace.
+          const prerelease = require(path.join(process.env.GITHUB_WORKSPACE,
+            '.github', 'scripts', 'prerelease-rank.js'));
+
           const DRY = process.env.DRY_RUN !== 'false';
           const CLOSE_UNMAINTAINED = process.env.CLOSE_UNMAINTAINED === 'true';
           const MERGE_GREEN = process.env.MERGE_GREEN === 'true';
@@ -307,25 +314,16 @@ jobs:
           // adding to a closed board is worse than adding to none. Within that, later
           // wins - GA over RC over M, and a higher number over a lower one - so the board
           // picked is the one the train is currently working toward.
-          const PRERELEASE = /^-(M|RC)(\d+)$/;
-          const boardRank = (title, base) => {
-            if (title === base) return [2, 0];
-            const m = title.startsWith(base) && title.slice(base.length).match(PRERELEASE);
-            if (!m) return null;
-            return [m[1] === 'RC' ? 1 : 0, Number(m[2])];
-          };
-
           const resolveBoard = base => {
             const candidates = [];
             for (const b of allBoards()) {
-              const rank = boardRank(b.title, base);
+              const rank = prerelease.rank(b.title, base);
               if (rank) candidates.push({ ...b, rank });
             }
             if (!candidates.length) return null;
-            candidates.sort((x, y) =>
-              (x.closed - y.closed) ||
-              (y.rank[0] - x.rank[0]) ||
-              (y.rank[1] - x.rank[1]));
+            // Open before closed, then furthest along. The scan applies the same rule to
+            // milestones, minus the closed test - it only ever lists open ones.
+            candidates.sort((x, y) => (x.closed - y.closed) || prerelease.byRankDesc(x, y));
             return candidates[0];
           };
 
@@ -552,7 +550,14 @@ jobs:
             if (pr.isReleaseBranch) {
               const needsProject = pr.projectState !== 'n/a';
               if (!milestoneOk || (needsProject && !projectOk)) {
-                const missing = [!milestoneOk && 'milestone',
+                // Say which milestone is in the way, not just that one is. "waiting on
+                // milestone" reads as "has none" when the usual cause is the opposite - a
+                // PR carrying the previous train's milestone, which triage will not
+                // overwrite, so the row otherwise contradicts the visible PR.
+                const milestoneReason = pr.currentMilestone
+                  ? `milestone is ${pr.currentMilestone}, expected ${pr.expectedMilestone}`
+                  : `milestone ${pr.expectedMilestone} not set`;
+                const missing = [!milestoneOk && milestoneReason,
                   needsProject && !projectOk && 'project'].filter(Boolean).join(' and ');
                 record(pr, 'merge', 'skipped', `not filed yet - waiting on ${missing}`);
                 continue;