Keep pm packages in the pm-toolchain Dependabot group by unbraind · Pull Request #120 · unbraind/pm-presets

unbraind · 2026-10-04T16:53:33Z

What

dependencies group now has exclude-patterns: ["@unbrained/pm-cli", "pm-*"], so it is disjoint from pm-toolchain.

Why

After #118 merged, Dependabot regrouped the open updates into #119 and put pm-ops (2026.9.28 → 2026.9.29) into the generic dependencies group instead of pm-toolchain. pm packages must move together (pm-ops's newer releases expect a newer @unbrained/pm-cli), so they may only ever be bumped in pm-toolchain.

Evidence that #118 works

chore(deps-dev): bump the dependencies group with 2 updates #119 was opened by Dependabot and dependabot-auto-merge enabled squash auto-merge on it (run succeeded on dependabot/npm_and_yarn/dependencies-852671bb2a).
One red run is a benign race: Dependabot closed chore(deps-dev): bump @types/node from 26.6.2 to 26.6.3 #112 as superseded while the job was enabling auto-merge on it.

pm item

pm-v1it — closed here with the evidence above.

Summary by Sourcery

Keep pm packages synchronized by making Dependabot groups disjoint and tightening automatic merge eligibility for other dependency updates.

Enhancements:

Keep pm-toolchain packages exclusively in their dedicated Dependabot group so they are updated together.
Restrict automatic merging of non-pm-toolchain Dependabot updates to minor and patch releases, leaving major or unclassified updates for manual review.

CI:

Grant the Dependabot auto-merge workflow the permissions required to enable squash auto-merge.

Summary by cubic

Keeps pm packages out of the generic dependencies Dependabot group so they can only be bumped together in pm-toolchain.

After #118, Dependabot routed pm-ops into dependencies, where it was capped at 2026.9.29 instead of moving in sync with new @unbrained/pm-cli releases. The dependencies group now explicitly selects every npm package except the pm-toolchain patterns (@unbrained/pm-cli, pm-*), making the two groups disjoint. The auto-merge workflow also now requires updates outside pm-toolchain to be explicitly classified as minor or patch, so an unclassified or major update waits for a person.

^{Written for commit 0198f54. Summary will update on new commits.}

After #118 Dependabot put pm-ops into the generic dependencies group, where it was capped at 2026.9.29 by itself instead of moving with @unbrained/pm-cli. The dependencies group now excludes the pm-toolchain patterns so the groups are disjoint. Closes pm-v1it with the auto-merge proof from #119. pm item: pm-v1it

sourcery-ai

Sorry @unbraind, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 1 day and 15 hours by commenting @sourcery-ai review. Upgrade to get a review now.

coderabbitai · 2026-10-04T16:53:40Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 8f65cd81-1b59-40b5-8e30-32590f87725f

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

sourcery-ai · 2026-10-04T16:53:46Z

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

The PR prevents Dependabot from placing @unbrained/pm-cli or pm-* packages in the generic dependencies group, keeping the PM toolchain updates together, and records the task closure and evidence that the prior auto-merge workflow works.

Flow diagram for Dependabot package grouping

flowchart LR
    Updates[Dependabot updates]
    PM[pm-toolchain group]
    Generic[dependencies group]
    Merge[Auto-merge workflow]

    Updates -->|"@unbrained/pm-cli or pm-*"| PM
    Updates -->|other packages| Generic
    PM --> Merge
    Generic --> Merge

File-Level Changes

Change	Details	Files
Make the generic Dependabot dependency group disjoint from the PM toolchain group.	Exclude @unbrained/pm-cli from generic dependency updates. Exclude all pm-* packages from generic dependency updates. Retain minor and patch update limits for the generic group while ensuring PM packages are bumped only with the toolchain.	`.github/dependabot.yml`
Record completion of the associated PM task and supporting Dependabot evidence.	Add task history entries documenting closure and evidence. Update the PM task record with the implementation and validation details.	`.agents/pm/history/pm-v1it.jsonl` `.agents/pm/tasks/pm-v1it.toon`

Tips and commands

Interacting with Sourcery

Trigger a new review: Comment @sourcery-ai review on the pull request.
Continue discussions: Reply directly to Sourcery's review comments.
Generate a GitHub issue from a review comment: Ask Sourcery to create an
issue from a review comment by replying to it. You can also reply to a
review comment with @sourcery-ai issue to create an issue from it.
Generate a pull request title: Write @sourcery-ai anywhere in the pull
request title to generate a title at any time. You can also comment
@sourcery-ai title on the pull request to (re-)generate the title at any time.
Generate a pull request summary: Write @sourcery-ai summary anywhere in
the pull request body to generate a PR summary at any time exactly where you
want it. You can also comment @sourcery-ai summary on the pull request to
(re-)generate the summary at any time.
Generate reviewer's guide: Comment @sourcery-ai guide on the pull
request to (re-)generate the reviewer's guide at any time.
Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
pull request to resolve all Sourcery comments. Useful if you've already
addressed all the comments and don't want to see them anymore.
Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
request to dismiss all existing Sourcery reviews. Especially useful if you
want to start fresh with a new review - don't forget to comment
@sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

Enable or disable review features such as the Sourcery-generated pull request
summary, the reviewer's guide, and others.
Change the review language.
Add, remove or edit custom review instructions.
Adjust other review settings.

Getting Help

Contact our support team for questions or feedback.
Visit our documentation for detailed guides and information.
Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

greptile-apps · 2026-10-04T16:55:54Z

Confidence Score: 5/5

[High risk] Configures automated dependency updates and auto-merge for npm packages.

The PR appears safe to merge; no actionable issue was found.

What we checked:

pm packages enter the wrong group: The generic group excludes exactly the package patterns selected by pm-toolchain.
Unknown updates merge automatically: The changed condition accepts only explicit minor or patch values outside pm-toolchain.

Summary

Keeps pm packages in the dedicated pm-toolchain Dependabot group.

Explicitly excludes those packages from dependencies.
Requires other updates to be classified as minor or patch before enabling auto-merge.
Preserves automatic merging for calendar-versioned pm-toolchain updates.
Closes pm-v1it and records it in the changelog.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Dependabot update] --> B{pm package?}
  B -->|Yes| C[pm-toolchain group]
  B -->|No, minor or patch| D[dependencies group]
  C --> E[Enable squash auto-merge]
  D --> E
  F[Other major or unclassified update] --> G[Manual review]
  E --> H[GitHub merge requirements]

_{Reviews (3) · Last reviewed commit: "Merge branch 'main' into ci/keep-pm-pack..."}

…sions Review feedback: an update that fetch-metadata cannot classify must not auto-merge, so the condition now requires semver-minor or semver-patch outside the calendar-versioned pm-toolchain group. The job's write scopes are documented, the dependencies group selects every package explicitly, and the item's acceptance criteria name the pm-toolchain exception. pm item: pm-v1it

unbraind · 2026-10-04T17:23:46Z

@coderabbitai full review
@greptileai review

coderabbitai · 2026-10-04T17:23:53Z

Rate Limit Exceeded

@unbraind have exceeded the limit for the number of chat messages per hour. Please wait 54 minutes and 3 seconds before sending another message.

unbraind · 2026-10-04T18:03:53Z

@greptileai review
@coderabbitai review

coderabbitai · 2026-10-04T18:03:59Z

Rate Limit Exceeded

@unbraind have exceeded the limit for the number of chat messages per hour. Please wait 13 minutes and 57 seconds before sending another message.

sourcery-ai Bot reviewed Oct 4, 2026

View reviewed changes

Merge branch 'main' into ci/keep-pm-packages-in-the-pm-toolchain-group

0198f54

unbraind merged commit ad55d0c into main Oct 4, 2026
11 checks passed

unbraind deleted the ci/keep-pm-packages-in-the-pm-toolchain-group branch October 4, 2026 18:14

unbraind mentioned this pull request Oct 5, 2026

Certify pm-presets on PM CLI 2026.10.4 and consolidate pending dependency updates #117

Closed

Navigation Menu

Repository navigation

Keep pm packages in the pm-toolchain Dependabot group - #120

Keep pm packages in the pm-toolchain Dependabot group#120
unbraind merged 3 commits into
mainfrom
ci/keep-pm-packages-in-the-pm-toolchain-group

unbraind commented Oct 4, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

sourcery-ai Bot left a comment

Uh oh!

coderabbitai Bot commented Oct 4, 2026 •

edited

Loading

Uh oh!

sourcery-ai Bot commented Oct 4, 2026

Reviewer's Guide

Flow diagram for Dependabot package grouping

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

greptile-apps Bot commented Oct 4, 2026 •

edited

Loading

Uh oh!

unbraind commented Oct 4, 2026

Uh oh!

coderabbitai Bot commented Oct 4, 2026

Uh oh!

unbraind commented Oct 4, 2026

Uh oh!

coderabbitai Bot commented Oct 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

unbraind commented Oct 4, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

Evidence that #118 works

pm item

Summary by Sourcery

Summary by cubic

Uh oh!

sourcery-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sourcery-ai Bot commented Oct 4, 2026

Reviewer's Guide

Flow diagram for Dependabot package grouping

File-Level Changes

Interacting with Sourcery

Customizing Your Experience

Getting Help

Uh oh!

greptile-apps Bot commented Oct 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

unbraind commented Oct 4, 2026

Uh oh!

coderabbitai Bot commented Oct 4, 2026

Rate Limit Exceeded

Uh oh!

unbraind commented Oct 4, 2026

Uh oh!

coderabbitai Bot commented Oct 4, 2026

Rate Limit Exceeded

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

unbraind commented Oct 4, 2026 •

edited by cubic-dev-ai Bot

Loading

coderabbitai Bot commented Oct 4, 2026 •

edited

Loading

greptile-apps Bot commented Oct 4, 2026 •

edited

Loading