From 32e044e110c25d0e3797b9b5e50648c2fc9aa6f0 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 2 Aug 2026 03:38:55 +0000 Subject: [PATCH 1/3] =?UTF-8?q?chore(ci):=20add=20.github/dependabot.yml?= =?UTF-8?q?=20=E2=80=94=20ignore=20astro=20+=20vitest=20majors=20(closes?= =?UTF-8?q?=20#123)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds an explicit Dependabot config that stops the recurring astro-major PR churn against apps/docs (5 recurrences: #110, #116, #119, #121, #122) and pre-empts the same pattern for vitest majors across the workspace, both of which are blocked on coordinated migrations tracked in #115 and #120 respectively. Two directory entries mirror the repo's dependency graph: - /apps/docs — its own manifest with astro + starlight; ignores astro majors, groups patch/minor into a single npm_and_yarn PR. - / — Bun workspace root that resolves packages/*, integrations/*, and tooling/* via the shared root lockfile; ignores vitest majors. Divergence from the issue's proposed yaml: the vitest ignore moved from the apps/docs block to the root block, because apps/docs does not declare vitest — the ignore would never have fired there. Vitest lives in the root manifest and packages/*/@workkit/vitest-config, so the root entry is where the ignore takes effect. Each ignore entry carries an inline pointer to its tracker issue so it is obvious when the entry becomes removable. --- .github/dependabot.yml | 43 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..d573201 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,43 @@ +# Dependabot config — see issue #123 for context. +# +# NOTE: Adding this file explicitly enables Dependabot for the directories +# listed here and disables it everywhere else. Every directory we want +# covered must be enumerated. The two directories with their own +# package.json + resolved dependency graph are `/apps/docs` (Astro docs +# site) and `/` (Bun workspace root, which covers `packages/*`, +# `integrations/*`, and `tooling/*` via the root lockfile). +version: 2 +updates: + # apps/docs — has its own manifest with astro + starlight + tailwind. + - package-ecosystem: npm + directory: /apps/docs + schedule: + interval: weekly + groups: + npm_and_yarn: + patterns: + - "*" + update-types: + - patch + - minor + ignore: + # Astro majors are blocked on the Starlight/Tailwind coordinated + # migration tracked in #115. Remove this entry once that migration + # lands so Dependabot can resume bumping astro majors. + - dependency-name: astro + update-types: + - version-update:semver-major + + # Bun workspace root — resolves the transitive graph for every + # packages/*, integrations/*, and tooling/* manifest via the shared + # root lockfile. + - package-ecosystem: npm + directory: / + schedule: + interval: weekly + ignore: + # Vitest v3 -> v4 is a workspace-wide migration tracked in #120. + # Remove this entry once that migration lands. + - dependency-name: vitest + update-types: + - version-update:semver-major From c0dee6241e41f5f8560a2b0ab0f662504bedafc6 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 3 Aug 2026 03:46:50 +0000 Subject: [PATCH 2/3] =?UTF-8?q?docs(ci):=20clarify=20dependabot.yml=20head?= =?UTF-8?q?er=20=E2=80=94=20scope=20covered=20vs.=20examples/*=20out-of-sc?= =?UTF-8?q?ope?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Copilot review flagged that "the two directories with their own package.json" overstated the case since examples/* (8 dirs) also carry package.json. Rewrite the header to enumerate what the two entries actually cover (historical /apps/docs PR surface + workspace-root lockfile fan-out) and explicitly note examples/* is deliberately out of scope (not in the root workspaces glob, never produced a dependabot PR historically). Config semantics unchanged — comment-only edit. --- .github/dependabot.yml | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d573201..04ac49e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -2,10 +2,22 @@ # # NOTE: Adding this file explicitly enables Dependabot for the directories # listed here and disables it everywhere else. Every directory we want -# covered must be enumerated. The two directories with their own -# package.json + resolved dependency graph are `/apps/docs` (Astro docs -# site) and `/` (Bun workspace root, which covers `packages/*`, -# `integrations/*`, and `tooling/*` via the root lockfile). +# covered must be enumerated. +# +# We enumerate two scopes: +# - `/apps/docs` — Astro docs site manifest. Historically the only +# workspace directory where Dependabot surfaced version PRs (see the +# closed astro-major bumps #110/#116/#119/#121/#122), because astro +# is a direct dep declared here. +# - `/` — Bun workspace root + shared lockfile, which resolves every +# workspace member (`packages/*`, `integrations/*`, `tooling/*`, +# `apps/*`). Bumps applied here fan out to every workspace consumer. +# +# Deliberately out of scope: `examples/*`. Those directories carry their +# own `package.json` but are runnable sample worker code, not workspace +# members (the root `workspaces` glob is `packages/* integrations/* +# tooling/* apps/*` — no `examples/*`), and they have never produced a +# Dependabot PR historically. Leaving them unenumerated preserves that. version: 2 updates: # apps/docs — has its own manifest with astro + starlight + tailwind. From 3cacff9abe083fd8718af8241d967f7235bd53b5 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 3 Aug 2026 03:50:12 +0000 Subject: [PATCH 3/3] fix(ci): switch workspace-root dependabot entry to package-ecosystem: bun MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Addresses two CodeRabbit findings on #124: 1. (Major) Workspace root uses Bun — `packageManager: "bun@1.3.8"` in root package.json and only `bun.lock` in the repo. GitHub's `bun` package-ecosystem GA'd 2025-02 and is the correct declaration for bun-managed lockfiles; the `npm` ecosystem only covers npm/yarn/pnpm. /apps/docs stays on `npm` per CodeRabbit's specific recommendation — its manifest doesn't declare packageManager and Dependabot has been opening PRs against it as npm historically. 2. (Minor) Header comment narrowed to "scheduled version updates" and explicitly notes that Dependabot security updates are governed by repo settings, not this file — so unlisted manifests aren't unprotected, just excluded from the weekly version-bump PR flow. Verified: constitution:check --diff-only clean (0/0 across 33 packages), YAML parses to the expected two-entry structure with ecosystems {/apps/docs: npm, /: bun}. --- .github/dependabot.yml | 35 +++++++++++++++++++++++------------ 1 file changed, 23 insertions(+), 12 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 04ac49e..f833bde 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,10 +1,14 @@ # Dependabot config — see issue #123 for context. # -# NOTE: Adding this file explicitly enables Dependabot for the directories -# listed here and disables it everywhere else. Every directory we want -# covered must be enumerated. +# NOTE: This file configures Dependabot's SCHEDULED VERSION UPDATES only — +# the weekly PRs that bump `dependency-name` in a manifest to the newest +# allowed version. Every directory we want covered for those PRs must be +# enumerated below; unlisted directories will not receive version-update +# PRs. Dependabot SECURITY UPDATES (advisory-driven PRs and vulnerability +# alerts) are governed by the repository's Code security settings, not by +# this file, and remain in effect regardless of what is listed here. # -# We enumerate two scopes: +# We enumerate two scopes for scheduled version updates: # - `/apps/docs` — Astro docs site manifest. Historically the only # workspace directory where Dependabot surfaced version PRs (see the # closed astro-major bumps #110/#116/#119/#121/#122), because astro @@ -13,11 +17,12 @@ # workspace member (`packages/*`, `integrations/*`, `tooling/*`, # `apps/*`). Bumps applied here fan out to every workspace consumer. # -# Deliberately out of scope: `examples/*`. Those directories carry their -# own `package.json` but are runnable sample worker code, not workspace -# members (the root `workspaces` glob is `packages/* integrations/* -# tooling/* apps/*` — no `examples/*`), and they have never produced a -# Dependabot PR historically. Leaving them unenumerated preserves that. +# Deliberately out of scope for scheduled version updates: `examples/*`. +# Those directories carry their own `package.json` but are runnable sample +# worker code, not workspace members (the root `workspaces` glob is +# `packages/* integrations/* tooling/* apps/*` — no `examples/*`), and +# they have never produced a Dependabot version-update PR historically. +# Leaving them unenumerated preserves that. version: 2 updates: # apps/docs — has its own manifest with astro + starlight + tailwind. @@ -41,9 +46,15 @@ updates: - version-update:semver-major # Bun workspace root — resolves the transitive graph for every - # packages/*, integrations/*, and tooling/* manifest via the shared - # root lockfile. - - package-ecosystem: npm + # packages/*, integrations/*, tooling/*, and apps/* manifest via the + # shared root `bun.lock`. Root `package.json` declares + # `"packageManager": "bun@1.3.8"` and the only lockfile in the repo is + # `bun.lock`, so the root entry uses `package-ecosystem: bun` (GA'd + # 2025-02, distinct from the `npm` ecosystem which covers npm/yarn/pnpm + # manifests only). The /apps/docs entry above stays on `npm` because + # its manifest does not declare `packageManager` and Dependabot has + # been happily surfacing PRs against it as npm historically. + - package-ecosystem: bun directory: / schedule: interval: weekly