docs(deps): record why desktop/ is not a Dependabot directory

[devantler]

Why

People keep rediscovering why grouped dependency updates seem to skip the desktop app's module. The real reason is that Dependabot never updates that module, and the step that actually keeps it in sync is written down only in the CI workflow, not next to the Dependabot config where people look.

What

Adds a short explanation to the Dependabot config. It says why the desktop module is deliberately not listed, which CI step keeps it in sync on every dependency PR, and what that costs (tracked in #7140). The config itself does not change.

Fixes #6816

🤖 Generated with Claude Code

https://claude.ai/code/session_011Aut24ni8XbKPYyY5mYrbb

---

Generated by Claude Code

[devantler]

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Evidence at head 658ccb36d3aa50d286cefd3e6bddc31e9da4a13c

No runtime surface. The change adds YAML comments only, so what Dependabot parses is unchanged. The parsed configuration (yq -S -c .) hashes to 80db48ea…93af on both main (1cf4577) and this head. RED/GREEN does not apply.

Validation run here: YAML parses, prettier@3 --check .github/dependabot.yaml passes, and every added line is at most 84 characters, within the length the file already uses. MegaLinter (yamllint) could not run here and is left to CI.

The facts recorded, checked against live state rather than memory:

• desktop/go.mod has exactly two direct requirements: the replaced ksail/v7 and wails/v3. Wails is not in the root go.mod. Every dependency the desktop module shares with the root is therefore listed there as // indirect, and Dependabot version updates only touch direct dependencies by default.
• On the grouped talos PR chore(deps): bump the talos group across 1 directory with 3 updates #6826, head a4971d2, desktop's files arrive through the CI sync commit. 🧩 Verify Desktop Module Tidy and 📦 Tidy both pass. The desktop build (job 105896103711) fails on the real dependency incompatibility: Talos MachineConfig.Kubelet undefined, the loft-sh/apiserver AllowCreateOnUpdate(context.Context) mismatch, and the cri-client CheckpointPod gap. It does not fail on go: updates to go.mod needed. That meets fix(deps): grouped gomod updates skip the desktop module, so the talos group PR fails before reaching the real bump #6816's second acceptance criterion. Its first criterion is met by the same PR, which does change desktop's files.
• Dependabot security updates do reach /desktop (chore(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.46.0 in /desktop in the go_modules group across 1 directory #7118, "in /desktop in the go_modules group"), so the comment says so.

---

Generated by Claude Code

[github-actions]

✅MegaLinter analysis: Success

✅ Linters with no issues

actionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_GITLEAKS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

---

Generated by Claude Code

[coderabbitai]

Rate Limit Exceeded

@devantler have exceeded the limit for the number of chat messages per hour. Please wait 4 minutes and 36 seconds before sending another message.

[devantler]

🤖 Generated by the Agentic Engineer

Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)

Reviewed commit: 658ccb36d3aa50d286cefd3e6bddc31e9da4a13c

• CodeRabbit: requested at this head at 2026-09-22T21:33Z (comment 5784529584); replied "Rate Limit Exceeded … number of chat messages per hour" at 2026-09-22T21:33:37Z (comment 5784531375), so no review at this head
• Codex: usage limit reached (measured 2026-09-22T20:53:06Z on monorepo#3507; maintainer-only, not re-requested)
• Cursor Bugbot: usage limit reached (measured 2026-09-22T20:53:35Z on monorepo#3507; maintainer-only, not re-requested)

What I checked:

• Correctness: the change is YAML comments only. The parsed configuration (yq, keys sorted, JSON) hashes identically on main (1cf4577) and this head (80db48ea…93af), so Dependabot's behaviour cannot change.
• Every factual claim in the comment against live state: desktop/go.mod has exactly two direct requirements (ksail/v7 via replace => ../, and wails/v3, which the root does not require), so every shared dependency is // indirect there; #7118 is a Dependabot security update "in /desktop"; the 📋 Apply patches step in ci.yaml restricts a Dependabot branch to desktop-tidy.patch (#6974); #7185 (2026-09-22) shows the resulting ksail-bot commit touching only desktop/go.mod and desktop/go.sum; #7140 is open and records the lost rebase ability.
• #6816's acceptance criteria: criteria 1 and 2 are met under the current mechanism by grouped talos PR #6826 (a4971d2, sync commit dated 2026-09-19): desktop files updated, and desktop build job 105896103711 fails on MachineConfig.Kubelet, AllowCreateOnUpdate(context.Context) and CheckpointPod, not on go: updates to go.mod needed. The only remaining criterion is recording the mechanism and its reasoning in dependabot.yaml, which this PR does, so Fixes #6816 is justified.
• Security: no workflow, trigger, permission or secret change; no executable surface.
• Merge interplay: merges cleanly with main and with #7199 (both edit dependabot.yaml in separate hunks; git merge-tree clean, merged text coherent).
• CI at this head: 53 check runs, all success or skipped; MegaLinter (yamllint, prettier) green.

Verdict: no P0/P1 findings

---

Generated by Claude Code