From a4bc2edf27a17081133c401c6cd484c5b2cc24a7 Mon Sep 17 00:00:00 2001
From: Dietmar Borgards <2646931+dborgards@users.noreply.github.com>
Date: Tue, 20 Oct 2026 15:59:39 +0200
Subject: [PATCH] ci(deps): the dotnet-tools entries that ship nothing form the
 repo-tooling group

gitversion.tool and defaultdocumentation.console were in no group, so a
bump (#283) carried the plain build(deps) subject that .releaserc.json
maps to a patch release of nine unchanged packages. They are grouped as
repo-tooling, with the security-updates twin test-tooling has, the
release rule leaves that name out too, and verify-release-config.mjs
checks both subjects.

Closes #328

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 .github/dependabot.yml        | 18 ++++++++++++++++--
 .releaserc.json               |  2 +-
 eng/verify-release-config.mjs |  7 +++++--
 3 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 75c43c89..8e58fd44 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,8 +8,8 @@ updates:
     open-pull-requests-limit: 5
     commit-message:
       # A shipped dependency moving is a change in the packages, so .releaserc.json lets
-      # `build(deps)` publish a patch -- except for the `test-tooling` group below, which it
-      # recognises by that name in the subject ("Bump the test-tooling group ..."). 1.3.0 carried
+      # `build(deps)` publish a patch -- except for the `test-tooling` and `repo-tooling` groups
+      # below, which it recognises by name in the subject ("Bump the test-tooling group ..."). 1.3.0 carried
       # coverlet and Polyfill bumps as release entries for want of this split (#257). Rename the
       # group and the rule in .releaserc.json has to follow; eng/verify-release-config.mjs
       # checks the rule against a subject of this shape.
@@ -42,6 +42,20 @@ updates:
           - "AwesomeAssertions"
           - "Polyfill"
           - "PublicApiGenerator"
+      # The other entries of .config/dotnet-tools.json: GitVersion computes the version and
+      # DefaultDocumentation renders the API reference, neither is part of a package. Ungrouped,
+      # a bump of either (#283) carried the plain `build(deps)` subject and would have released a
+      # patch of nine unchanged packages. .releaserc.json recognises this group by name as it
+      # does `test-tooling`; rename it and that rule has to follow (#328).
+      repo-tooling:
+        patterns:
+          - "gitversion.tool"
+          - "defaultdocumentation.console"
+      repo-tooling-security:
+        applies-to: security-updates
+        patterns:
+          - "gitversion.tool"
+          - "defaultdocumentation.console"
     ignore:
       # CanKit is the upstream this product is built on; moving to a new version is a decision
       # about compatibility and testing, made by bumping CanKitVersion in eng/Dependencies.props.
diff --git a/.releaserc.json b/.releaserc.json
index 38055e29..6c094b52 100644
--- a/.releaserc.json
+++ b/.releaserc.json
@@ -10,7 +10,7 @@
         { "type": "fix", "release": "patch" },
         { "type": "perf", "release": "patch" },
         { "type": "revert", "release": "patch" },
-        { "type": "build", "scope": "deps", "subject": "!(*test-tooling*)", "release": "patch" },
+        { "type": "build", "scope": "deps", "subject": "!(*test-tooling*|*repo-tooling*)", "release": "patch" },
         { "type": "docs", "release": false },
         { "type": "test", "release": false },
         { "type": "chore", "release": false },
diff --git a/eng/verify-release-config.mjs b/eng/verify-release-config.mjs
index 81f96a90..0c4af835 100644
--- a/eng/verify-release-config.mjs
+++ b/eng/verify-release-config.mjs
@@ -41,8 +41,9 @@ if (!Array.isArray(config.branches) || config.branches.length === 0) {
 }
 
 // What a Dependabot commit publishes (#257). A shipped dependency moving is a patch; the
-// `test-tooling` group (.github/dependabot.yml) tests nothing that ships, so it publishes nothing
-// -- the rule tells them apart by the group's name in the subject. Run through the analyser
+// `test-tooling` group (.github/dependabot.yml) tests nothing that ships, and the `repo-tooling`
+// group builds and documents without shipping either, so neither publishes anything -- the rule
+// tells them apart by the group's name in the subject. Run through the analyser
 // itself, with the configured rules, because the matching is not obvious: a later `release: false`
 // rule beats an earlier match, a glob negation lives in the subject, and a typo in either passes
 // every resolvability check above while releasing nine packages for a coverlet bump.
@@ -68,6 +69,8 @@ if (analyzerOptions) {
   await expectRelease('build(deps): Bump the test-tooling group with 1 update', null);
   await expectRelease('build(deps): Bump the test-tooling group across 1 directory with 2 updates', null);
   await expectRelease('build(deps): Bump the test-tooling-security group with 1 update', null);
+  await expectRelease('build(deps): Bump the repo-tooling group with 1 update', null);
+  await expectRelease('build(deps): Bump the repo-tooling-security group with 1 update', null);
   await expectRelease('build(deps): Bump EdsDcfNet from 1.14.0 to 1.15.0', 'patch');
   await expectRelease('chore(deps): Bump the semantic-release group with 3 updates', null);
 }