Repository navigation
ci: batch weekly dependabot updates for cargo, npm and actions - #44
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Intent
Dependabot: set up batched weekly PRs on thokr, fsrx and gh-eco? yes. Context: gh-eco already has .github/dependabot.yml (gomod + github-actions, weekly, one PR per dependency), which opened about 5 separate PRs at once. The proposal the captain approved: on each repo, batch minor and patch updates into one weekly PR per ecosystem, keep major versions as their own PRs (they need a real check), and cover the repo's language dependencies plus GitHub Actions versions (for thokr, also the web demo's npm packages).
What Changed
.github/dependabot.ymlwith weekly update checks for cargo (/and/web/enginein one entry), npm (/web) and GitHub Actions (/).Risk Assessment
✅ Low: The change is a CI config file and nothing else. It covers cargo (both the root crate and web/engine, each with its own lockfile), npm (/web) and github-actions with weekly minor/patch groups, and majors stay ungrouped as separate PRs. That meets the intent and the user's round-1 fix decision.
Testing
The diff is a Dependabot config file only, and only GitHub's Dependabot service runs it. I parsed the YAML into a semantic model. There is one weekly cargo group covering both / and /web/engine, as the review decision asked. There is one npm group for /web and one github-actions group. Each group batches only minor and patch updates, so majors get their own PRs. Every target directory has the manifest Dependabot needs. No Dependabot run was possible locally, so the verdict is no-surface. No UI changed, so there are no screenshots.
Evidence: Dependabot config semantic check
cargo | / | target present cargo | /web/engine | target present interval: weekly | groups: {"cargo-minor-patch":["minor","patch"]} npm | /web | target present interval: weekly | groups: {"npm-minor-patch":["minor","patch"]} github-actions | / | target present interval: weekly | groups: {"github-actions-minor-patch":["minor","patch"]}Pipeline
Updates from git push no-mistakes
✅ **intent** - passed
✅ No issues found.
✅ **Rebase** - passed
✅ No issues found.
🔧 **Review** - 1 issue found → auto-fixed ✅
.github/dependabot.yml:2- Intent asks to "batch minor and patch updates into one weekly PR per ecosystem". The config has two separate cargo entries:directory: /with groupcargo-minor-patchat line 3, anddirectory: /web/enginewith groupcargo-web-engine-minor-patchat line 12. That gives two cargo PRs each week, not one. It also matters for correctness. web/engine compiles thokr's own ../../src modules against its own Cargo.lock, and it shares ratatui, clap, rand and cgisf_lib with the root crate. With two PRs, one can merge without the other, and the shared crates then drift to different versions between the TUI and the web build. Suggested fix: one cargo entry withdirectories: ["/", "/web/engine"]and a single minor/patch group. Dependabot then opens one grouped PR covering both lockfiles. Confirm whether one cargo PR is wanted, or whether two per-directory PRs are acceptable.🔧 Fix applied.
✅ Re-checked - no issues remain.
Parsed.github/dependabot.ymlwith the npmyamlpackage in a throwaway temp dir. Checked version 2, the weekly interval, the minor/patch group types, and that each target directory has its manifest (Cargo.toml, package.json, .github/workflows)git diff --stat 5fba3f9 HEAD: only .github/dependabot.yml changed✅ **Document** - passed
✅ No issues found.
✅ **Lint** - passed
✅ No issues found.
✅ **Push** - passed
✅ No issues found.