feat: optimize update lavamoat policies#41479
Conversation
|
CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes. |
Builds ready [39b66d1]
⚡ Performance Benchmarks (Total: 🟢 6 pass · 🟡 12 warn · 🔴 0 fail)
🌐 Dapp Page Load BenchmarksCurrent Commit: 📄 Localhost MetaMask Test DappSamples: 100 Summary
📈 Detailed Results
Bundle size diffs
|
Builds ready [deb0e22] [reused from a07a331]
⚡ Performance Benchmarks (Total: 🟢 7 pass · 🟡 8 warn · 🔴 0 fail)
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|
Builds ready [ccfd304] [reused from a07a331]
⚡ Performance Benchmarks (Total: 🟢 7 pass · 🟡 8 warn · 🔴 0 fail)
Bundle size diffs [🚨 Warning! Bundle size has increased!]
|
Builds ready [b956b7c] [reused from 93f8855]
⚡ Performance Benchmarks (Total: 🟢 7 pass · 🟡 12 warn · 🔴 0 fail)
Bundle size diffs
|
Builds ready [6ed3c49] [reused from 93f8855]
⚡ Performance Benchmarks (Total: 🟢 7 pass · 🟡 12 warn · 🔴 0 fail)
Bundle size diffs
|
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 6ed3c49. Configure here.
|




Description
How it works
Changelog
CHANGELOG entry:
Related issues
Fixes: MetaMask/MetaMask-planning#7150
Manual testing steps
Screenshots/Recordings
Not applicable
Pre-merge author checklist
Pre-merge reviewer checklist
Note
Medium Risk
Changes the automation that updates LavaMoat policies by relying on artifacts from an existing CI run instead of regenerating policies, so failures or mismatched CI artifacts could prevent updates or apply incomplete diffs. No runtime product code is changed, but it touches security-review tooling.
Overview
Reworks the
@metamaskbot update-policiesworkflow to stop regenerating LavaMoat policies in dedicated jobs and instead locate the PR’smain.ymlCI run, detect whethervalidate-lavamoat-policiesis pending/skipped/failed, and act accordingly.When validation fails, the bot now downloads uploaded
.patchartifacts, applies them, commits/pushes the updated policy files, and posts more specific PR comments (including listing failed validation jobs); it also adds workflowconcurrencyand reduces job timeouts.Updates
validate-lavamoat-policies.ymlto capturegit diffoutput into patch files and upload those diffs as artifacts on failure, enabling the new update flow.Reviewed by Cursor Bugbot for commit 6ed3c49. Bugbot is set up for automated code reviews on this repo. Configure here.