From cfe2ba7af83d5186f2673380c43c36b8e2ce5c27 Mon Sep 17 00:00:00 2001 From: Edwin <18327273+thinkbig1979@users.noreply.github.com> Date: Fri, 31 Jul 2026 17:40:28 +0200 Subject: [PATCH] chore(ci): record the verified Dependabot x minimumReleaseAge result The comment said the interaction was being verified rather than assumed. It has now been verified, so the comment should say what was found. Dependabot PR #22 (npm minor+patch group, 36 updates) ran frontend CI's `pnpm install --frozen-lockfile` against a Dependabot-generated lockfile and the install step succeeded. A frozen install replays the lockfile rather than resolving, so pnpm's minimumReleaseAge: 10080 quarantine never applies. The two controls do not conflict. That PR failed overall on Lint, from a new rule shipped by one of the updated dev dependencies flagging pre-existing code in DashboardPage.tsx. Recorded explicitly so the failure is not later misread as evidence against the cooldown. Refs: agent-os-o9l Co-Authored-By: Claude Opus 5 --- .github/dependabot.yml | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6c6d020..fe5d99b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -54,12 +54,21 @@ updates: # published hours ago — a version pnpm itself would refuse. The cooldown below # aligns the two windows so Dependabot only proposes versions pnpm will accept. # - # The interaction to watch: frontend CI runs `pnpm install --frozen-lockfile` - # (.github/workflows/frontend.yml:51). A frozen install replays the lockfile - # rather than resolving, so minimumReleaseAge should not apply to it — but that - # is reasoning, not evidence, and it is being verified on a real Dependabot PR - # rather than assumed. If a fresh-resolution path does trip the quarantine, the - # fix is to widen the cooldown, not to weaken minimumReleaseAge. + # VERIFIED 2026-07-31, on Dependabot PR #22 (the npm minor+patch group, 36 + # updates): frontend CI's `pnpm install --frozen-lockfile` + # (.github/workflows/frontend.yml:51) succeeded against a Dependabot-generated + # lockfile. A frozen install replays the lockfile rather than resolving, so the + # quarantine never applies to it. The two controls do not conflict. + # + # That PR did fail overall, on Lint, because a new rule shipped by one of the + # updated dev dependencies flagged pre-existing code. That is an ordinary + # consequence of updating, not a supply-chain-control interaction — worth + # stating so the failure is not later misread as evidence against the cooldown. + # + # The cooldown above stays regardless: it keeps Dependabot from proposing a + # version pnpm would refuse on any path that *does* resolve. If a + # fresh-resolution path ever trips the quarantine, widen the cooldown rather + # than weaken minimumReleaseAge. - package-ecosystem: npm directory: /frontend schedule: