Skip to content

[MINOR] chore(.github): group dependabot security updates by path#5213

Open
jongyoul wants to merge 2 commits intoapache:masterfrom
jongyoul:minor/dependabot-security-groups
Open

[MINOR] chore(.github): group dependabot security updates by path#5213
jongyoul wants to merge 2 commits intoapache:masterfrom
jongyoul:minor/dependabot-security-groups

Conversation

@jongyoul
Copy link
Copy Markdown
Member

@jongyoul jongyoul commented Apr 12, 2026

What is this PR for?

Group Dependabot security updates by exact path so the current burst of one-off security PRs can be regenerated as grouped PRs instead.

This configuration intentionally keeps non-security version updates disabled with open-pull-requests-limit: 0, so it only affects grouped security updates and does not start regular version-update PRs for these directories.

Covered paths:

  • /docs
  • /zeppelin-web
  • /zeppelin-web-angular
  • /dev
  • /
  • /alluxio
  • /bigquery
  • /elasticsearch
  • /flink/flink-scala-2.12
  • /livy
  • /rlang
  • /shell
  • /spark/interpreter
  • /spark/spark-scala-parent
  • /zeppelin-interpreter
  • /zeppelin-plugins/launcher/docker
  • /zeppelin-plugins/launcher/k8s-standard
  • /zeppelin-plugins/notebookrepo/s3

First time? Check out the contributing guide - https://zeppelin.apache.org/contribution/contributions.html

What type of PR is it?

Improvement

Todos

  • Add .github/dependabot.yml for the targeted directories
  • Verify the configured directory names match the repository
  • Expand coverage to the remaining open Dependabot security-update paths
  • Clarify that the config is intentionally security-updates-only

What is the Jira issue?

None. Minor maintenance change.

How should this be tested?

  • Confirm .github/dependabot.yml is valid YAML.
  • Confirm each configured directory exists in the repository.
  • After merge, verify Dependabot opens grouped security update PRs for the listed paths.

Screenshots (if appropriate)

N/A

Questions:

  • Does the license files need to update? No.
  • Is there breaking changes for older versions? No.
  • Does this needs documentation? No.

Configure Dependabot to group security updates for /docs, /zeppelin-web, and /zeppelin-web-angular into separate pull requests.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings April 12, 2026 15:03
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a Dependabot configuration to group security update PRs by top-level path so each of /docs, /zeppelin-web, and /zeppelin-web-angular receives a single grouped security-update PR instead of many individual PRs.

Changes:

  • Introduces .github/dependabot.yml with update entries for Bundler (/docs) and npm (/zeppelin-web, /zeppelin-web-angular)
  • Configures Dependabot grouping for security updates using groups: … applies-to: security-updates

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Extend the Dependabot security update grouping config to cover the currently open dependency alert paths and clarify that version updates remain disabled.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants