From 7a0f5bbd7b74e5e119354c2978615855b5e4c22f Mon Sep 17 00:00:00 2001 From: Radoslaw Szwajkowski Date: Mon, 7 Sep 2026 23:14:17 +0200 Subject: [PATCH 1/2] Add multi-branch dependabot config For main branch: 1. in npm package system aggregate all updates in one PR (per branch). Include only minor and patch updates (both version and security). 2. in github actions package system aggregate all updates in one PR. Include all version updates (including major). Only main branch is supported as older branches have no github actions. 3. ignore shared modules provided (currently) by Console. Unused modules are ignored. For release branches: 1. update not only patch but also minor versions - reasoning is that: a) usually the latest minor version is the only version that receives security updates b) minor version should not contain breaking changes 2. ignore list is limited to dynamic SDK packages which is only a subset of all shared modules. The remaining packages follow the regular dependency update process - reasoning is that: a) production code is unchanged and minor and patch versions should be backwards compatible b) the Console is updating their deps in parallel so an up-to-date cluster may be close to our versions c) shorter ignore list is more readable - note that dependabot does not support yml aliases (yet) d) the shared modules list changed in time and would require different ignore lists per branch Note: 1. dependabot provides security updates only on default branch, however patch updates should address most of the security issues. 2. dependency-type "all" covers also transitive dependencies although the docs do not list npm as supported package manager 3. updates for release branches use custom commit message prefix Reference-Url: https://github.com/openshift/console/blob/c46e0aabe4c9cf330f1e56ad323076e7e8e7f7d8/frontend/packages/console-dynamic-plugin-sdk/src/shared-modules/shared-modules-meta.ts#L41 Reference-Url: https://github.com/dependabot/dependabot-core/issues/1582 Signed-off-by: Radoslaw Szwajkowski --- .github/dependabot.yml | 217 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 217 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..f9cc3b74 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,217 @@ +version: 2 +updates: + # Docker images are OpenShift CI streams, not Dependabot-managed + # - package-ecosystem: docker + + # --- main (default branch) --- + - package-ecosystem: github-actions + directory: / + cooldown: + default-days: 5 + schedule: + interval: monthly + groups: + github-actions: + patterns: + - '*' + + - package-ecosystem: npm + directory: / + cooldown: + default-days: 5 + schedule: + interval: weekly + day: monday + time: '07:00' + timezone: UTC + allow: + - dependency-type: all + update-types: + - version-update:semver-minor + - version-update:semver-patch + ignore: + # shared modules currently provided by Console (including unused) based on + # https://github.com/openshift/console/blob/c46e0aabe4c9cf330f1e56ad323076e7e8e7f7d8/frontend/packages/console-dynamic-plugin-sdk/src/shared-modules/shared-modules-meta.ts#L41 + - dependency-name: '@openshift/dynamic-plugin-sdk' + - dependency-name: '@openshift-console/dynamic-plugin-sdk' + - dependency-name: '@openshift-console/dynamic-plugin-sdk-internal' + - dependency-name: '@patternfly/react-topology' + - dependency-name: react + - dependency-name: react-i18next + - dependency-name: react-redux + - dependency-name: react-router + - dependency-name: react-router-dom + - dependency-name: react-router-dom-v5-compat + - dependency-name: redux + - dependency-name: redux-thunk + # not shared but effectively pinned to Console version + - dependency-name: '@openshift-console/dynamic-plugin-sdk-webpack' + groups: + npm: + applies-to: version-updates + patterns: + - '*' + npm-security: + applies-to: security-updates + patterns: + - '*' + + # --- release branches --- + # update also minor versions - reasoning is that: + # a) usually the latest minor version is the only version that receives security updates + # b) minor version should not contain breaking changes + # ignore list is limited to dynamic SDK packages which is only a subset of shared modules + # the remaining packages follow the regular dependency update process - reasoning is that: + # a) production code is unchanged and minor and patch versions should be backwards compatible + # b) the Console is updating their deps in parallel so an up-to-date cluster may be close to our versions + # c) shorter ignore list is more readable - note that dependabot does not support yml aliases (yet) + # d) the shared modules list changed in time and would require different ignore lists per branch + - package-ecosystem: npm + target-branch: release-4.23 + directory: / + commit-message: + prefix: 'chores(4.23)' + cooldown: + default-days: 5 + schedule: + interval: weekly + day: monday + time: '07:00' + timezone: UTC + ignore: + - dependency-name: '@openshift/dynamic-plugin-sdk' + - dependency-name: '@openshift-console/*' + allow: + - dependency-type: all + update-types: + - version-update:semver-minor + - version-update:semver-patch + groups: + npm: + patterns: + - '*' + + - package-ecosystem: npm + target-branch: release-4.22 + directory: / + commit-message: + prefix: 'chores(4.22)' + cooldown: + default-days: 5 + schedule: + interval: weekly + day: monday + time: '07:00' + timezone: UTC + ignore: + - dependency-name: '@openshift/dynamic-plugin-sdk' + - dependency-name: '@openshift-console/*' + allow: + - dependency-type: all + update-types: + - version-update:semver-minor + - version-update:semver-patch + groups: + npm: + patterns: + - '*' + + - package-ecosystem: npm + target-branch: release-4.21 + directory: / + commit-message: + prefix: 'chores(4.21)' + cooldown: + default-days: 5 + schedule: + interval: weekly + day: monday + time: '07:00' + timezone: UTC + ignore: + - dependency-name: '@openshift/dynamic-plugin-sdk' + - dependency-name: '@openshift-console/*' + allow: + - dependency-type: all + update-types: + - version-update:semver-minor + - version-update:semver-patch + groups: + npm: + patterns: + - '*' + + - package-ecosystem: npm + target-branch: release-4.20 + directory: / + commit-message: + prefix: 'chores(4.20)' + cooldown: + default-days: 5 + schedule: + interval: weekly + day: monday + time: '07:00' + timezone: UTC + ignore: + - dependency-name: '@openshift/dynamic-plugin-sdk' + - dependency-name: '@openshift-console/*' + allow: + - dependency-type: all + update-types: + - version-update:semver-minor + - version-update:semver-patch + groups: + npm: + patterns: + - '*' + + - package-ecosystem: npm + target-branch: release-4.19 + directory: / + commit-message: + prefix: 'chores(4.19)' + cooldown: + default-days: 5 + schedule: + interval: weekly + day: monday + time: '07:00' + timezone: UTC + ignore: + - dependency-name: '@openshift/dynamic-plugin-sdk' + - dependency-name: '@openshift-console/*' + allow: + - dependency-type: all + update-types: + - version-update:semver-minor + - version-update:semver-patch + groups: + npm: + patterns: + - '*' + + - package-ecosystem: npm + target-branch: release-4.18 + directory: / + commit-message: + prefix: 'chores(4.18)' + cooldown: + default-days: 5 + schedule: + interval: weekly + day: monday + time: '07:00' + timezone: UTC + ignore: + - dependency-name: '@openshift/dynamic-plugin-sdk' + - dependency-name: '@openshift-console/*' + allow: + - dependency-type: all + update-types: + - version-update:semver-minor + - version-update:semver-patch + groups: + npm: + patterns: + - '*' \ No newline at end of file From 4d6cc37f6a43f9547a4a84d73d33217b18ba188e Mon Sep 17 00:00:00 2001 From: Radoslaw Szwajkowski Date: Tue, 8 Sep 2026 18:20:26 +0200 Subject: [PATCH 2/2] Change dependabot commit message prefix For branch: a) main use 'maintenance'. b) release-X.Y use '[release-X.Y] maintenance'. Note that dependabot will insert a colon (':') after the prefix automatically. Additionally remove unsupported branch 4.18 from the config. Signed-off-by: Radoslaw Szwajkowski --- .github/dependabot.yml | 40 ++++++++++------------------------------ 1 file changed, 10 insertions(+), 30 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f9cc3b74..27ec4a73 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,6 +6,8 @@ updates: # --- main (default branch) --- - package-ecosystem: github-actions directory: / + commit-message: + prefix: 'maintenance' cooldown: default-days: 5 schedule: @@ -17,6 +19,8 @@ updates: - package-ecosystem: npm directory: / + commit-message: + prefix: 'maintenance' cooldown: default-days: 5 schedule: @@ -70,7 +74,7 @@ updates: target-branch: release-4.23 directory: / commit-message: - prefix: 'chores(4.23)' + prefix: '[release-4.23] maintenance' cooldown: default-days: 5 schedule: @@ -95,7 +99,7 @@ updates: target-branch: release-4.22 directory: / commit-message: - prefix: 'chores(4.22)' + prefix: '[release-4.22] maintenance' cooldown: default-days: 5 schedule: @@ -120,7 +124,7 @@ updates: target-branch: release-4.21 directory: / commit-message: - prefix: 'chores(4.21)' + prefix: '[release-4.21] maintenance' cooldown: default-days: 5 schedule: @@ -145,7 +149,7 @@ updates: target-branch: release-4.20 directory: / commit-message: - prefix: 'chores(4.20)' + prefix: '[release-4.20] maintenance' cooldown: default-days: 5 schedule: @@ -170,7 +174,7 @@ updates: target-branch: release-4.19 directory: / commit-message: - prefix: 'chores(4.19)' + prefix: '[release-4.19] maintenance' cooldown: default-days: 5 schedule: @@ -190,28 +194,4 @@ updates: npm: patterns: - '*' - - - package-ecosystem: npm - target-branch: release-4.18 - directory: / - commit-message: - prefix: 'chores(4.18)' - cooldown: - default-days: 5 - schedule: - interval: weekly - day: monday - time: '07:00' - timezone: UTC - ignore: - - dependency-name: '@openshift/dynamic-plugin-sdk' - - dependency-name: '@openshift-console/*' - allow: - - dependency-type: all - update-types: - - version-update:semver-minor - - version-update:semver-patch - groups: - npm: - patterns: - - '*' \ No newline at end of file +