Randomly sample Dependabot discovery batches

Select up to 32 eligible PRs per run with a partial Fisher-Yates shuffle.

Skip held PRs unless native auto-merge needs disarming. Document
probabilistic fairness and cover filtering, empty sets, and sampling
without replacement.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d63bcb34-3969-4d14-b422-33728176ec03

Author: cklin

.github/dependabot-automation/README.md

@@ -15,6 +15,12 @@ workflow completions, on an hourly schedule, or through manual dispatch. Each PR
 uses `../workflows/dependabot-pr.yml`, with concurrency scoped to that PR across
 the whole pipeline.
 
+Discovery excludes held PRs unless native auto-merge needs disarming. It randomly
+selects at most 32 candidates per run without replacement, using a partial
+Fisher-Yates shuffle. Every candidate has an equal chance of selection, but
+selection within a fixed number of runs is not guaranteed. Discovery logs
+selected and deferred counts.
+
 The controller is not a long-running process or an in-memory state machine. Each
 workflow step creates a fresh controller. Its inputs default to `PR_NUMBER`,
 `EXPECTED_SHA`, and the current working directory; tests can supply them explicitly.

.github/dependabot-automation/controller.cjs

@@ -43,11 +43,27 @@ function createController({
       base: "main",
       per_page: 100,
     });
-    const candidates = pulls.filter((pr) => isCandidate(pr, repository));
-    if (candidates.length > 256)
-      throw new Error("Too many PRs for the job matrix");
-    core.setOutput("prs", JSON.stringify(candidates.map((pr) => pr.number)));
-    core.setOutput("has-prs", candidates.length > 0);
+    const candidates = pulls.filter(
+      (pr) =>
+        isCandidate(pr, repository) &&
+        (!hasAutomationHold(pr) || Boolean(pr.auto_merge)),
+    );
+    const batchSize = 32;
+    const count = Math.min(batchSize, candidates.length);
+    for (let index = 0; index < count; index++) {
+      const other =
+        index + Math.floor(Math.random() * (candidates.length - index));
+      [candidates[index], candidates[other]] = [
+        candidates[other],
+        candidates[index],
+      ];
+    }
+    const selected = candidates.slice(0, count);
+    core.info(
+      `Selected ${selected.length} of ${candidates.length} eligible PRs; deferred ${candidates.length - selected.length}.`,
+    );
+    core.setOutput("prs", JSON.stringify(selected.map((pr) => pr.number)));
+    core.setOutput("has-prs", selected.length > 0);
   }
 
   async function evaluate() {

.github/dependabot-automation/controller.test.cjs

@@ -191,6 +191,73 @@ function harness({ workspace } = {}) {
   return { state, github, controller, result };
 }
 
+test("discovery excludes held PRs unless native auto-merge needs disarming", async () => {
+  const { controller, state, github } = harness();
+  github.rest.pulls.list = () =>
+    [
+      { ...candidate(), number: 10 },
+      { ...candidate(), number: 20, labels: [{ name: "dependencies" }] },
+      {
+        ...candidate(),
+        number: 30,
+        labels: [{ name: reviewLabel }],
+      },
+      {
+        ...candidate(),
+        number: 40,
+        labels: [{ name: reviewLabel }],
+        auto_merge: {},
+      },
+      { ...candidate(), number: 50, draft: true, auto_merge: {} },
+    ].reverse();
+  await controller.discover();
+  assert.deepEqual(
+    JSON.parse(state.outputs.prs).sort((a, b) => a - b),
+    [10, 20, 40],
+  );
+  assert.equal(state.outputs["has-prs"], true);
+  assert.deepEqual(state.calls, []);
+});
+
+test("discovery produces an empty matrix when no candidates remain", async (t) => {
+  for (const [name, pulls] of [
+    ["no PRs", []],
+    ["all held", [{ ...candidate(), labels: [{ name: reviewLabel }] }]],
+  ]) {
+    await t.test(name, async () => {
+      const { controller, state, github } = harness();
+      github.rest.pulls.list = () => pulls;
+      await controller.discover();
+      assert.deepEqual(JSON.parse(state.outputs.prs), []);
+      assert.equal(state.outputs["has-prs"], false);
+    });
+  }
+});
+
+test("discovery randomly selects bounded batches without replacement", async (t) => {
+  const numbers = Array.from({ length: 300 }, (_, index) => index + 1);
+  const pulls = numbers.map((number) => ({ ...candidate(), number }));
+  for (const [random, expected] of [
+    [0, numbers.slice(0, 32)],
+    [1 - Number.EPSILON, [300, ...numbers.slice(0, 31)]],
+  ]) {
+    await t.test(`random value ${random}`, async (t) => {
+      t.mock.method(Math, "random", () => random);
+      const { controller, state, github } = harness();
+      github.rest.pulls.list = () => pulls;
+      await controller.discover();
+      const batch = JSON.parse(state.outputs.prs);
+      assert.deepEqual(batch, expected);
+      assert.equal(new Set(batch).size, 32);
+      assert.equal(state.outputs["has-prs"], true);
+      assert.deepEqual(
+        pulls.map((pr) => pr.number),
+        numbers,
+      );
+    });
+  }
+});
+
 test("only open, non-draft, same-repository Dependabot PRs qualify", () => {
   const pr = candidate();
   assert(isCandidate(pr, "github/vscode-codeql"));