Skip to content

Comments

Revert YAML anchors approach - Dependabot doesn't support them#249

Closed
Copilot wants to merge 3 commits intonev21/DependabotUpdatesfrom
copilot/sub-pr-248
Closed

Revert YAML anchors approach - Dependabot doesn't support them#249
Copilot wants to merge 3 commits intonev21/DependabotUpdatesfrom
copilot/sub-pr-248

Conversation

Copy link
Contributor

Copilot AI commented Dec 25, 2025

Addresses a Dependabot parser limitation discovered when attempting to reduce duplication in .github/dependabot.yml.

Background

The original goal was to eliminate duplication where identical groups configuration was repeated across three npm package ecosystems. An attempt was made to use YAML anchors and aliases to define the configuration once and reuse it.

Issue Discovered

Dependabot's configuration parser does not support YAML anchors and aliases, despite them being valid YAML syntax. The parser raised the error: "YAML aliases are not supported"

Resolution

Reverted to the original configuration format where the groups configuration is explicitly duplicated across all three npm package ecosystems (root "/", "/dbg", and "/providers").

# Current approach: Groups duplicated across npm ecosystems
- package-ecosystem: "npm"
  directory: "/"
  groups:
    nevware21:
      patterns:
        - "@nevware21/*"
    # ... repeated for each ecosystem

- package-ecosystem: "npm"
  directory: "/dbg"
  groups:
    nevware21:
      patterns:
        - "@nevware21/*"
    # ... same configuration

- package-ecosystem: "npm"
  directory: "/providers"
  groups:
    nevware21:
      patterns:
        - "@nevware21/*"
    # ... same configuration

While this approach contains duplication, it's the only format that Dependabot's parser currently supports. Future changes to dependency grouping logic will need to be manually updated in all three locations.


💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Co-authored-by: nev21 <82737406+nev21@users.noreply.github.com>
Copilot AI changed the title [WIP] Update Dependabot configuration for groups Refactor dependabot.yml to use YAML anchors for DRY groups config Dec 25, 2025
Copilot AI requested a review from nev21 December 25, 2025 18:22
Copy link
Contributor

@nev21 nev21 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dependabot couldn't parse the config file at .github/dependabot.yml. The error raised was:

YAML aliases are not supported
Please ensure the config file is a valid YAML file. An online YAML linter is available here.

Co-authored-by: nev21 <82737406+nev21@users.noreply.github.com>
Copy link
Contributor Author

Copilot AI commented Dec 25, 2025

Dependabot couldn't parse the config file at .github/dependabot.yml. The error raised was:

YAML aliases are not supported
...

I've reverted the YAML anchors approach in commit ae734a0. Unfortunately, Dependabot's parser doesn't support YAML anchors/aliases, even though they're part of the YAML specification. This is a known limitation of Dependabot's configuration parser.

The configuration is now back to the original format with the groups duplicated across the three npm ecosystems. While this means maintaining the same configuration in three places, it's the only approach that Dependabot currently supports.

If reducing duplication is still desired, the alternative would be to consolidate the three npm directories into a single monorepo structure, but that would require significant repository restructuring beyond the scope of this PR.

Copilot AI changed the title Refactor dependabot.yml to use YAML anchors for DRY groups config Revert YAML anchors approach - Dependabot doesn't support them Dec 25, 2025
Copilot AI requested a review from nev21 December 25, 2025 18:25
@nev21 nev21 closed this Dec 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants