Dependency Bot Backlog and Degradation Ledger from Dashboard Issues

A dependency update bot writes one dashboard issue in each repository that it serves. That issue declares the problems of the repository, and it lists the updates that wait: pending approval, awaiting schedule, pending status checks, group size not met, abandoned dependencies, and open errors. The issue is public, but it is visible only inside its repository.

This Actor reads the dashboard issue of up to 250 repositories in one run, and gives one table: the dashboard URL, the last dashboard update, the days since that update, the declared problems, the size of each backlog section, and the change of each number against the baseline of the last run. It shows, in one place, where the bot is degraded and where the backlog grows.

HTTP only. GitHub REST search and issue endpoints. No browser, no proxy, no database, and no token for a small fleet.

What the Actor does

For each repository:

1. It searches the open issues for the dashboard title (one REST search call).
2. It keeps the issue whose body reads as a dependency dashboard. An issue with a similar title but another body is never reported. When the search answer holds no body, the Actor reads that issue with one extra call.
3. It parses the body: the declared problems under Repository Problems, and the item count of each backlog section. The parser reads the task list items, then the count in a <details> summary line, then the rows of a table, and last the plain bullet lines, so a section keeps its count when the bot changes the shape of the list.
4. It compares the problems and the counts against the baseline in the named key-value store, and writes one row for each new problem and for each backlog section that grew.
5. It writes the new baseline, but only after the rows of the repository are written.

The first run of a repository writes the baseline and reports no change. Every later run gives the delta.

Input

Field	Type	Default	Meaning
repositories	array	3 public example repositories	1 to 250 public repositories, as owner/repo or as https://github.com/owner/repo. A value that is not a public GitHub repository becomes an invalid-target row. The run does not fail.
dashboardIssueTitle	string	Dashboard	A phrase that the title of the dashboard issue holds. Use Dependency Dashboard for the standard title, or a shorter phrase when your bot renames the issue.
backlogAgeThresholdDays	integer	7	A dashboard with no update for more days than this value is reported as stale, which shows that the bot did not serve the repository.
growthThreshold	integer	1	The smallest growth of one backlog section that becomes a change event.
githubToken	string (secret)	none	Optional read-only token. Without a token the Actor uses the anonymous GitHub limit, which other users of the same IP address can share.
stateStoreName	string	dependency-dashboard-ledger-state	The named key-value store that holds the baseline of each repository. Runs with the same name share the baseline.
timeoutSeconds	integer	20	Timeout of one GitHub API call.
maxResponseBytes	integer	4000000	Hard cap on the bytes read from one answer.

Every field has a default, so a run with empty input {} works.

Output

One dataset row for each repository, one row for each detected change, one row for each invalid input value, and one summary row at the end.

Repository row

recordType is repository.

Field	Meaning
repository	The owner/repo value.
status	OK for a dashboard that was read.
dashboardUrl, issueNumber, dashboardTitle	The dashboard issue.
lastDashboardUpdate, daysSinceUpdate	The last update of the issue, and the age in days.
dashboardStale	True when the age passes backlogAgeThresholdDays.
problems, problemCount	The declared repository problems, with their severity.
newProblems, resolvedProblems	The problems that came and the problems that went, against the baseline.
pendingApproval, awaitingSchedule, pendingStatusChecks, groupSizeNotMet, abandonedDependencies, openErrors	The size of each backlog section.
totalBacklog	The sum of the six sections.
pendingApprovalDelta, awaitingScheduleDelta, pendingStatusChecksDelta, groupSizeNotMetDelta, abandonedDependenciesDelta, openErrorsDelta, totalBacklogDelta	The change against the baseline. null on the first run.
baselineExisted	False on the first run of the repository.
bodyTruncated	True when the bot truncated the dashboard body, so the counts can be lower than the true backlog.
changeEvents, note, checkedAt	The count of change rows, a readable note, and the time of the read.

Change row

recordType is change. One row for each new problem (changeType new-problem) and for each backlog section that grew (changeType backlog-growth), with section, problem, severity, previousCount, currentCount and delta.

Summary row

recordType is summary, with runStatus, dashboardsRead, declaredProblems, newProblems, backlogGrowthEvents, changeEvents, staleDashboards, totalBacklog and the note of the run.

Business verdicts never fail the run

A repository without a dashboard, a repository that GitHub answers 404 for, a spent rate budget, an invalid input value and a ledger with zero changes are all rows plus a status message. The run ends SUCCEEDED. Only a real malfunction gives a FAILED run.

When the run stops early (runStatus is partial), the stopReason says why: charge-limit, rate-limited, token-rejected or request-limit. The repositories that are left keep their baseline, so the next run reads them and no change is lost.

Charged events

The Actor uses pay-per-event pricing with two events:

Event	Charged for	Count
dashboard-repository-read	One dashboard issue that the Actor found and parsed	One for each repository with a dashboard. A repository without a dashboard, or one that GitHub cannot answer for, is never charged.
problem-or-backlog-change-detected	One new repository problem, or one backlog section that grew by growthThreshold or more	One for each such change. The first run of a repository writes the baseline and charges no change event.

The Actor reads the maximum total charge that you set. When the limit cannot hold every change of a repository, the Actor reports none of them, keeps the baseline of that repository, and stops with stopReason charge-limit, so no change is charged twice and none is lost.

Rate limits

Without a token GitHub allows few calls for each hour, and other users of the same IP address share that budget. One repository needs one call, or two when the search answer holds no body. For a fleet of many repositories, supply a read-only githubToken. When GitHub refuses a call, the run stops with rate-limited, keeps every baseline, and the next run continues.

Development

uv run pytest
uv run ruff check .