ci: track dependencies with Dependabot, and auto-merge the low-risk half - #8
Merged
Conversation
This repo had no `dependabot.yml` at all, so nothing was watching its dependencies: not the sibling packages it is built on, not the third-party ones, not the actions its workflows pin. Every other package in the ecosystem has had that watch for months. Grouping follows the rest of the org: minor and patch roll up into one PR per bucket so the queue stays short, a major opens its own PR because a breaking change earns a human, and the schedule is Monday morning Europe/Istanbul. `dependabot-auto-merge.yml` is the same workflow the other repos now run, and its scope stays narrow on purpose: `github_actions` minor and patch only. A pub dependency reaches this package's own resolution graph, so it keeps a human.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
.github/dependabot.yml..github/workflows/dependabot-auto-merge.yml, the same one the rest of the ecosystem now runs, targetingmain.Why
This repo had no Dependabot config at all, so nothing watched its dependencies while every sibling package has had that watch for months.
Grouping follows the org pattern: minor and patch roll up into one PR per bucket, a major opens its own because a breaking change earns a human, schedule is Monday 06:00 Europe/Istanbul.
Auto-merge scope stays narrow:
github_actionsminor and patch only. A pub dependency reaches this package's own resolution graph, so it keeps a human. There is no approve step, becauseGITHUB_TOKENcannot approve a pull request and a permanently red check trains you to ignore red checks.Testing
actionlintclean, config parses as valid YAML with the expected ecosystem/directory pairs. Labels the config references were created in this repo first, so the first bump does not open unlabelled.