Repository navigation
Group leynos/shared-actions bumps into one Dependabot PR - #750
Conversation
A bump of a leynos/shared-actions pin moves one commit SHA to another, and a SHA-to-SHA update has no semver level. The github-actions catch-all is limited to minor and patch, so it never took these updates and each pinned action or reusable workflow arrived as its own pull request. Add a `shared-actions` group with no update-types ahead of the catch-all, because Dependabot uses the first group that matches. Third-party action majors do not match its pattern and stay individual.
bincode 3.0.0 is a `compile_error!` stub, so a version bump to it can never build and only produces a failing pull request. Ignore versions at or above 3 for the cargo entry until a usable release exists.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Reviewer's guide (collapsed on small PRs)Reviewer's GuideUpdates Dependabot configuration so shared-actions SHA bumps arrive together in one daily pull request, while preserving existing third-party action behavior, and ignores unusable bincode 3 releases. Flow diagram for Dependabot grouping and filteringflowchart TD
D[Dependabot update] --> M{Matches leynos/shared-actions*}
M -->|Yes| S[shared-actions group]
M -->|No| G[github-actions group]
G --> T{Update is minor or patch}
T -->|Yes| G
T -->|No| I[Individual pull request]
S --> P[One daily grouped pull request]
C[Cargo update] --> B{bincode version >= 3}
B -->|Yes| X[Ignore update]
B -->|No| U[Normal Cargo update handling]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
📒 Files selected for processing (1)
🔗 Linked repositories identifiedCodeRabbit considers these linked repositories for cross-repo context during reviews:
Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour. Summary
WalkthroughDependabot now groups updates for ChangesDependabot update rules
Priority: ⬇️ Low Change: Other Merge Risk: ⚪ Minimal · up to The changes narrowly group the named shared-action updates and exclude bincode versions 3 and later. No actionable merge-blocking risk is established. Caution Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional.
❌ Failed checks (1 error)
✅ Passed checks (14 passed)
Full details: Testing (Unit And Behavioural)Explanation The change alters the externally observable Dependabot workflow, but it adds no behavioural or end-to-end test. The diff changes only Resolution Add a CI integration test at the Dependabot boundary. Verify that
Group shared actions as updates arrive Comment |
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Summary
Dependabot opens one pull request per pinned
leynos/shared-actionsaction orreusable workflow. A bump of such a pin moves one commit SHA to another, which
has no semver level, so the
github-actionsgroup (limited tominorandpatch) never takes it. Each bump therefore arrives alone.This adds a
shared-actionsgroup with the patternleynos/shared-actions*andno
update-types, placed ahead of the existing group because Dependabot usesthe first group that matches. All shared-actions pin bumps now arrive in one
daily pull request. Third-party actions do not match the pattern, so their
majors stay individual pull requests and their minor and patch bumps still use
the existing group. Nothing else in the file changes.
Validation
yamllintreports no finding that the base file did not already have.dependencieslabel, which a grouped pull request still carries, so groupingdoes not change eligibility.
.github/dependabot.yml, so this is aconfig-only change.
End-to-end evidence
The pilot on leynos/lag-complexity proves the grouping live: before the change that repository had five separate shared-actions pull requests open at once; after it merged, Dependabot closed the stale singles and opened one grouped pull request, "Bump the shared-actions group with 4 updates" (leynos/lag-complexity#154), which merged. This repository has had 0 separate shared-actions bump pull requests merged since 5 October.
Overlap
Open pull request the open drafts #650 and #709 are old agent drafts that also edit .github/dependabot.yml. This change does not touch it; whichever merges second rebases.
bincode 3 ignore
This repository depends on bincode, and bincode 3.0.0 is a
compile_error!stub, so Dependabot's bump to it cannot build (mxd #572 was closed for this
reason). A second commit adds
ignore: bincode >= 3to the cargo entry. It is adependabot.yml-only change and shares this pull request.Summary by Sourcery
Configure Dependabot to consolidate shared-actions updates and avoid proposing unusable bincode 3 upgrades.
Enhancements:
Chores: