chore(ci): extend dependabot to docs/ npm and Docker, group minor/patch bumps - #235
Open
BenjaminDEMAILLE wants to merge 3 commits into
Open
chore(ci): extend dependabot to docs/ npm and Docker, group minor/patch bumps#235BenjaminDEMAILLE wants to merge 3 commits into
BenjaminDEMAILLE wants to merge 3 commits into
Conversation
…p updates The config watched cargo and github-actions only, so the Astro Starlight site in docs/ (pnpm) and the two Dockerfile base images were never updated. Minor and patch bumps are now grouped into one PR per ecosystem per week; major bumps stay individual because they need review. Adds per-ecosystem commit-message prefixes and open-pull-requests-limit to cut PR churn. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Zethson
reviewed
Aug 26, 2026
Zethson
left a comment
Zethson
left a comment
Member
There was a problem hiding this comment.
I'd even be down for monthly & an open PR limit of like 1 to drastically reduce noise.
Review feedback: monthly schedule and open-pull-requests-limit 1 across all four ecosystems, to cut update noise further. Security update PRs are exempt from the limit and do not count toward it, so they still arrive immediately. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
Author
|
Done in 378a74f: Two consequences worth having on record:
Rebased on |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
.github/dependabot.ymlalready existed and works (see the openchore(deps)PRs), but it watched only two ecosystems.Gaps closed
docs/(npm/pnpm) — the Astro Starlight site (docs/package.json,docs/pnpm-lock.yaml:astro,@astrojs/starlight,sharp) was never updated.rust:1-bookworm,debian:bookworm-slim) was tracked.Noise reduction
Minor and patch updates are grouped into one PR per ecosystem per week. Major bumps deliberately stay ungrouped: they need a real review, and a grouped major is hard to bisect.
open-pull-requests-limitis 5 per ecosystem (3 for Docker).Per-ecosystem commit prefixes so the history stays readable:
chore(deps)for cargo,chore(ci)for actions,chore(docs)for the site,chore(docker)for base images.Verification
YAML parses and every group declares
patterns: ["*"]plus explicitupdate-types. Config only: no source, workflow, or build change. GitHub validates the file on merge and reports problems in Insights > Dependency graph > Dependabot.🤖 Generated with Claude Code