chore: group Dependabot updates and slow the cadence to monthly - #68
Merged
Conversation
Applies GitHub's "Tame Dependabot" guidance: group routine version bumps into one PR per ecosystem, move the schedule to monthly, and add a 7-day cooldown so a release has time to be found bad and yanked before it is proposed here. One deliberate departure from the article, which says to delete `open-pull-requests-limit`. Omitting that key does not mean unlimited -- the default is 5, and once five version-update PRs are open Dependabot raises no more. That is the silent withholding the article argues against, so the limit is instead set explicitly and set high (50 for cargo, 20 elsewhere), high enough not to bind. Grouping is what controls the noise. Cargo needs the extra headroom because Dependabot applies Cargo's semver rules, where a 0.y.z crate's y-bump is breaking: `0.8 -> 0.9` counts as a major, falls out of the group, and arrives as its own PR. Security updates are untouched. `applies-to` defaults to `version-updates`, so security PRs ignore the grouping, schedule, cooldown and limit, and keep arriving one per advisory, immediately. Major bumps are also left ungrouped: every group matches only `minor` and `patch`, so a major still gets its own PR and its own review. Ref: https://github.blog/security/supply-chain-security/tame-dependabot-group-your-updates-slow-the-cadence-keep-security-fast/ [AI-assisted - Claude]
A comment in dependabot.yml reaches whoever reads the config; it does not reach whoever reviews the monthly bump PR, which is where the decision is actually made. These workspaces reach a contract or delegate crate, so a grouped cargo bump can change compiled WASM and move a contract address. Tagging those PRs `contract-rekey-risk` puts the warning on the PR itself. The label exists in each repo, since Dependabot silently drops labels that do not. Note this does not fire every month: a bump only moves the address if it reaches a contract crate's dependency graph, and those crates are small (freenet-stdlib, ciborium, serde, ed25519-dalek, blake3). A group bumping only native deps leaves the WASM byte-identical. [AI-assisted - Claude]
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Applies GitHub's "Tame Dependabot" guidance: group routine version bumps
into one PR per ecosystem, move the schedule to monthly, and add a 7-day
cooldown so a release has time to be found bad and yanked before it is
proposed here.
One deliberate departure from the article, which says to delete
open-pull-requests-limit. Omitting that key does not mean unlimited --the default is 5, and once five version-update PRs are open Dependabot
raises no more. That is the silent withholding the article argues against,
so the limit is instead set explicitly and set high (50 for cargo, 20
elsewhere), high enough not to bind. Grouping is what controls the noise.
Cargo needs the extra headroom because Dependabot applies Cargo's semver
rules, where a 0.y.z crate's y-bump is breaking:
0.8 -> 0.9counts as amajor, falls out of the group, and arrives as its own PR.
Security updates are untouched.
applies-todefaults toversion-updates,so security PRs ignore the grouping, schedule, cooldown and limit, and keep
arriving one per advisory, immediately.
Major bumps are also left ungrouped: every group matches only
minorandpatch, so a major still gets its own PR and its own review.Ref: https://github.blog/security/supply-chain-security/tame-dependabot-group-your-updates-slow-the-cadence-keep-security-fast/
[AI-assisted - Claude]