From b49ee1b9dd60c935a1ff4a586e5ec448a8b038e0 Mon Sep 17 00:00:00 2001 From: coding-dev-tools Date: Sun, 1 Nov 2026 02:55:08 -0500 Subject: [PATCH 1/2] chore(ci): let dependabot rebase its own branches main requires branches to be up to date before merging (strict required checks), so every merge leaves the other dependency PRs behind and needs a manual update-branch plus a full CI cycle. rebase-strategy: auto keeps them current without that dance. --- .github/dependabot.yml | 108 ++++++++++++++++++++++------------------- 1 file changed, 58 insertions(+), 50 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f29e84beb..008da47c4 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,50 +1,58 @@ -version: 2 -updates: - - package-ecosystem: "pip" - directory: "/" - schedule: - interval: "weekly" - open-pull-requests-limit: 5 - # This file reproduces retained campaigns and must match their observed inventory. - # New campaigns use benchmark-requirements-windows-py312-current.txt instead. - exclude-paths: - - "eval/configs/benchmark-requirements-windows-py312.txt" - # MCP 2 changes the server API; migrate and qualify it separately. - ignore: - - dependency-name: "mcp" - update-types: ["version-update:semver-major"] - labels: - - "dependencies" - - package-ecosystem: "npm" - directory: "/" - schedule: - interval: "weekly" - open-pull-requests-limit: 3 - # The shipped force-graph bundle has local CSP patches and locked provenance. - # Version upgrades follow docs/DASHBOARD_VENDOR_ASSETS.md; security updates remain enabled. - ignore: - - dependency-name: "force-graph" - update-types: - - "version-update:semver-major" - - "version-update:semver-minor" - - "version-update:semver-patch" - labels: - - "dependencies" - - package-ecosystem: "docker" - directory: "/" - schedule: - interval: "weekly" - open-pull-requests-limit: 3 - labels: - - "dependencies" - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - open-pull-requests-limit: 3 - groups: - # codeql-action's init and analyze steps must always bump together — - # a mixed-version pair fails CodeQL's analyze post-action step. - codeql-action: - patterns: - - "github/codeql-action/*" +version: 2 +updates: + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "weekly" + # Keep open PRs mergeable: main requires branches to be up to date before merging. + rebase-strategy: "auto" + open-pull-requests-limit: 5 + # This file reproduces retained campaigns and must match their observed inventory. + # New campaigns use benchmark-requirements-windows-py312-current.txt instead. + exclude-paths: + - "eval/configs/benchmark-requirements-windows-py312.txt" + # MCP 2 changes the server API; migrate and qualify it separately. + ignore: + - dependency-name: "mcp" + update-types: ["version-update:semver-major"] + labels: + - "dependencies" + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "weekly" + # Keep open PRs mergeable: main requires branches to be up to date before merging. + rebase-strategy: "auto" + open-pull-requests-limit: 3 + # The shipped force-graph bundle has local CSP patches and locked provenance. + # Version upgrades follow docs/DASHBOARD_VENDOR_ASSETS.md; security updates remain enabled. + ignore: + - dependency-name: "force-graph" + update-types: + - "version-update:semver-major" + - "version-update:semver-minor" + - "version-update:semver-patch" + labels: + - "dependencies" + - package-ecosystem: "docker" + directory: "/" + schedule: + interval: "weekly" + # Keep open PRs mergeable: main requires branches to be up to date before merging. + rebase-strategy: "auto" + open-pull-requests-limit: 3 + labels: + - "dependencies" + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + # Keep open PRs mergeable: main requires branches to be up to date before merging. + rebase-strategy: "auto" + open-pull-requests-limit: 3 + groups: + # codeql-action's init and analyze steps must always bump together — + # a mixed-version pair fails CodeQL's analyze post-action step. + codeql-action: + patterns: + - "github/codeql-action/*" From 94e39ce383fc3f77a979df9fe455c18996b56146 Mon Sep 17 00:00:00 2001 From: coding-dev-tools Date: Sun, 1 Nov 2026 02:55:18 -0500 Subject: [PATCH 2/2] chore(ci): keep the dependabot config line endings stable --- .github/dependabot.yml | 116 ++++++++++++++++++++--------------------- 1 file changed, 58 insertions(+), 58 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 008da47c4..bcead6ac1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,58 +1,58 @@ -version: 2 -updates: - - package-ecosystem: "pip" - directory: "/" - schedule: - interval: "weekly" - # Keep open PRs mergeable: main requires branches to be up to date before merging. - rebase-strategy: "auto" - open-pull-requests-limit: 5 - # This file reproduces retained campaigns and must match their observed inventory. - # New campaigns use benchmark-requirements-windows-py312-current.txt instead. - exclude-paths: - - "eval/configs/benchmark-requirements-windows-py312.txt" - # MCP 2 changes the server API; migrate and qualify it separately. - ignore: - - dependency-name: "mcp" - update-types: ["version-update:semver-major"] - labels: - - "dependencies" - - package-ecosystem: "npm" - directory: "/" - schedule: - interval: "weekly" - # Keep open PRs mergeable: main requires branches to be up to date before merging. - rebase-strategy: "auto" - open-pull-requests-limit: 3 - # The shipped force-graph bundle has local CSP patches and locked provenance. - # Version upgrades follow docs/DASHBOARD_VENDOR_ASSETS.md; security updates remain enabled. - ignore: - - dependency-name: "force-graph" - update-types: - - "version-update:semver-major" - - "version-update:semver-minor" - - "version-update:semver-patch" - labels: - - "dependencies" - - package-ecosystem: "docker" - directory: "/" - schedule: - interval: "weekly" - # Keep open PRs mergeable: main requires branches to be up to date before merging. - rebase-strategy: "auto" - open-pull-requests-limit: 3 - labels: - - "dependencies" - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - # Keep open PRs mergeable: main requires branches to be up to date before merging. - rebase-strategy: "auto" - open-pull-requests-limit: 3 - groups: - # codeql-action's init and analyze steps must always bump together — - # a mixed-version pair fails CodeQL's analyze post-action step. - codeql-action: - patterns: - - "github/codeql-action/*" +version: 2 +updates: + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "weekly" + # Keep open PRs mergeable: main requires branches to be up to date before merging. + rebase-strategy: "auto" + open-pull-requests-limit: 5 + # This file reproduces retained campaigns and must match their observed inventory. + # New campaigns use benchmark-requirements-windows-py312-current.txt instead. + exclude-paths: + - "eval/configs/benchmark-requirements-windows-py312.txt" + # MCP 2 changes the server API; migrate and qualify it separately. + ignore: + - dependency-name: "mcp" + update-types: ["version-update:semver-major"] + labels: + - "dependencies" + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "weekly" + # Keep open PRs mergeable: main requires branches to be up to date before merging. + rebase-strategy: "auto" + open-pull-requests-limit: 3 + # The shipped force-graph bundle has local CSP patches and locked provenance. + # Version upgrades follow docs/DASHBOARD_VENDOR_ASSETS.md; security updates remain enabled. + ignore: + - dependency-name: "force-graph" + update-types: + - "version-update:semver-major" + - "version-update:semver-minor" + - "version-update:semver-patch" + labels: + - "dependencies" + - package-ecosystem: "docker" + directory: "/" + schedule: + interval: "weekly" + # Keep open PRs mergeable: main requires branches to be up to date before merging. + rebase-strategy: "auto" + open-pull-requests-limit: 3 + labels: + - "dependencies" + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + # Keep open PRs mergeable: main requires branches to be up to date before merging. + rebase-strategy: "auto" + open-pull-requests-limit: 3 + groups: + # codeql-action's init and analyze steps must always bump together — + # a mixed-version pair fails CodeQL's analyze post-action step. + codeql-action: + patterns: + - "github/codeql-action/*"