ci: add dependabot for npm, www, and github actions#32
Merged
Conversation
Adds weekly Dependabot version updates across all three ecosystems: the root create-scn-stack CLI (npm), the scnstack.sh site (npm/pnpm in /www), and GitHub Actions. Updates are grouped per ecosystem to reduce PR noise and use Conventional Commit prefixes (chore/ci) plus project labels so they pass commit-check. Also adds ignore_authors to the [branch] section of cchk.toml so commit-check does not reject Dependabot's dependabot/* branches, which do not follow Conventional Branch naming.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds Dependabot version updates and ensures its PRs pass CI:
.github/dependabot.yml— weekly updates for all three ecosystems..github/cchk.toml— addsignore_authorsto the[branch]section so commit-check doesn't reject Dependabot's branches.Why
The repo has three dependency surfaces with no automated update path: the root CLI (
package-lock.json), the website (www/pnpm-lock.yaml), and the GitHub Actions used in workflows. Dependabot keeps them current and surfaces security patches.Without the
cchk.tomlchange, every Dependabot PR would fail the commit-check branch check — Dependabot opens PRs fromdependabot/*branches, which don't match the Conventional Branch types. I verified this locally (adependabot/...branch returns[FAIL]). Addingignore_authorsto[branch]bypasses the branch check for the bot, the same way it's already bypassed for commit messages.Closes #
Type
ci— CI/CD changesHow
npmat/(CLI),npmat/www(pnpm lockfile — Dependabot's npm ecosystem handles pnpm), andgithub-actionsat/.chore(deps):/ci(deps):) so they passallow_commit_types; labels (chore,ci,website) come from the existing label set.ignore_authors = ["dependabot[bot]", "renovate[bot]", "copilot[bot]"]added to[branch](previously only under[commit]).Testing
dependabot/*branch fails the branch check today (confirms the fix is needed)commit-check --branch/--message— pass on this PRnpm run lint— passes ·npm test— 62/62 passScreenshots
N/A — CI configuration.