botpr

package

v0.15.2 Latest Latest Go to latest Published: Jun 6, 2026 License: MIT Imports: 2 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/mptooling/notifycat

Links

Open Source Insights

Documentation ¶

Overview ¶

Package botpr classifies pull requests opened by dependency-update bots (Dependabot, Renovate) so the notifier can render a compact Slack message instead of the standard "please review" format, and tell routine version bumps apart from security-advisory updates.

Detection is deliberately narrow: an exact, case-insensitive match on the two known bot logins (no prefix matching, no operator-configurable allowlist), and a conservative header-anchored scan of the PR body for the advisory section. A body parse miss falls back to the routine kind — never the other way around — so a template change on GitHub's side degrades a security PR to routine, not a routine PR to a false alarm.

Index ¶

func IsSecurityAdvisory(prBody string) bool
type BotKind
- func DetectBot(login string) BotKind
- func (k BotKind) Name() string

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func IsSecurityAdvisory ¶

func IsSecurityAdvisory(prBody string) bool

IsSecurityAdvisory reports whether prBody carries the advisory section that marks a security update. A miss returns false (routine) — the safe default.

Types ¶

type BotKind ¶

type BotKind int

BotKind identifies which dependency bot opened a PR, or BotKindNone for anything else (humans and unrecognised bots alike).

const (
	BotKindNone BotKind = iota
	BotKindDependabot
	BotKindRenovate
)

Bot kinds returned by DetectBot. BotKindNone covers humans and any bot that is not one of the two recognised dependency updaters.

func DetectBot ¶

func DetectBot(login string) BotKind

DetectBot matches login against the two known bot logins, case-insensitively. The surface is exactly two values, so the match is exact — prefix matching ("dependabot") is intentionally not a hit. Callers pass the PR author so the classification follows who opened the PR, not who fired the webhook.

func (BotKind) Name ¶

func (k BotKind) Name() string

Name returns the lowercase bot name used in the composed message ("dependabot" / "renovate"), or "" for BotKindNone.

Source Files ¶

View all Source files

botpr.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL