From 2df4bcc2ef2bfd520b23e21db68fac6186f58a28 Mon Sep 17 00:00:00 2001 From: 3uzbcqje <3uzbcqje@addy.to> Date: Sun, 13 Sep 2026 17:08:27 -0700 Subject: [PATCH] chore(deps): consolidate dependabot into one grouped PR, minor/patch only Routine version updates are limited to minor and patch; semver-major bumps are ignored. The version-update: prefix scopes that ignore to version updates only, so a security advisory that can only be fixed by a major bump still opens a PR. Updates are grouped so they arrive as a single PR rather than one per dependency. Security advisories are grouped separately, per ecosystem. Mirrors the configuration proven on alaska-rcv, where it took 15 open Dependabot PRs down to 1. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01FpuRSSAYEkdSSgnaFaoBKK --- .github/dependabot.yml | 125 ++++++++++++++++++++++++----------------- 1 file changed, 74 insertions(+), 51 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e878b7762..7db8eb0f3 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,44 +1,67 @@ -# Dependabot version updates. +# Dependabot configuration. # -# Minor and patch bumps are grouped into a single PR per ecosystem to keep -# review overhead low. Major bumps are deliberately left ungrouped so each one -# gets its own PR and a real review. +# Policy (set deliberately -- please read before editing): # -# A cooldown holds brand-new releases for a few days, which blunts compromised- -# release supply-chain attacks. Only semver ecosystems accept semver-*-days; -# docker, docker-compose, github-actions, terraform and pip take default-days -# alone and are rejected outright if given the semver keys. +# 1. Routine version updates are minor/patch only. The `ignore` block drops +# semver-major bumps. The `version-update:` prefix scopes that ignore to +# VERSION updates only, so a security advisory whose only fix is a major +# bump still opens a PR. Never drop the `update-types:` key from that +# ignore entry -- a bare `dependency-name: "*"` would also silence +# security updates. # -# A group only covers security-advisory PRs if it sets -# `applies-to: security-updates` -- a group without that key defaults to -# version updates alone, which leaves advisories arriving one PR per advisory. -# The *-security groups below bundle them per ecosystem. Those deliberately -# include majors: declining a security fix because it is a major bump is not a -# real option. +# 2. Everything lands in as few PRs as possible. +# `multi-ecosystem-groups` merges every ecosystem in this repo into ONE +# pull request per week. # -# Docs: https://docs.github.com/code-security/dependabot/dependabot-version-updates +# 3. Security advisories are grouped per ecosystem by the `*-security` +# groups below. A multi-ecosystem group covers VERSION +# updates only -- it has no `applies-to` key -- so without these, +# advisories would arrive one PR per advisory. +# +# 4. `open-pull-requests-limit` is deliberately ABSENT. Dependabot rejects the +# whole file if it appears on an update entry belonging to a +# multi-ecosystem group, and the published JSON schema does NOT catch +# that -- only Dependabot's own validator does. Setting it on the group +# instead is documented as correct but was never confirmed to parse, so +# it is left off: the group raises one PR regardless, and security PRs +# are exempt from the limit in any case. +# +# 5. Cooldown holds brand-new releases for a few days, which blunts +# compromised-release supply-chain attacks. Only semver ecosystems accept +# `semver-*-days`; docker, docker-compose, github-actions, terraform and +# pip take `default-days` alone and are REJECTED if given the semver keys. +# +# Docs: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference version: 2 -updates: +multi-ecosystem-groups: + all-dependencies: + schedule: + interval: weekly + day: monday + time: "06:00" + labels: + - dependencies +updates: - package-ecosystem: npm directories: - / - /testing - /.github/scripts - schedule: - interval: weekly - open-pull-requests-limit: 10 + multi-ecosystem-group: all-dependencies + patterns: + - "*" cooldown: default-days: 7 semver-major-days: 30 semver-minor-days: 7 semver-patch-days: 3 - groups: - npm: + ignore: + - dependency-name: "*" update-types: - - minor - - patch + - version-update:semver-major + groups: npm-security: applies-to: security-updates patterns: @@ -46,19 +69,19 @@ updates: - package-ecosystem: bundler directory: /docs - schedule: - interval: weekly - open-pull-requests-limit: 10 + multi-ecosystem-group: all-dependencies + patterns: + - "*" cooldown: default-days: 7 semver-major-days: 30 semver-minor-days: 7 semver-patch-days: 3 - groups: - bundler: + ignore: + - dependency-name: "*" update-types: - - minor - - patch + - version-update:semver-major + groups: bundler-security: applies-to: security-updates patterns: @@ -69,16 +92,16 @@ updates: - / - /testing - /.sandcastle - schedule: - interval: weekly - open-pull-requests-limit: 10 + multi-ecosystem-group: all-dependencies + patterns: + - "*" cooldown: default-days: 7 - groups: - docker: + ignore: + - dependency-name: "*" update-types: - - minor - - patch + - version-update:semver-major + groups: docker-security: applies-to: security-updates patterns: @@ -86,16 +109,16 @@ updates: - package-ecosystem: docker-compose directory: / - schedule: - interval: weekly - open-pull-requests-limit: 10 + multi-ecosystem-group: all-dependencies + patterns: + - "*" cooldown: default-days: 7 - groups: - docker-compose: + ignore: + - dependency-name: "*" update-types: - - minor - - patch + - version-update:semver-major + groups: docker-compose-security: applies-to: security-updates patterns: @@ -103,16 +126,16 @@ updates: - package-ecosystem: github-actions directory: / - schedule: - interval: weekly - open-pull-requests-limit: 10 + multi-ecosystem-group: all-dependencies + patterns: + - "*" cooldown: default-days: 7 - groups: - github-actions: + ignore: + - dependency-name: "*" update-types: - - minor - - patch + - version-update:semver-major + groups: github-actions-security: applies-to: security-updates patterns: