ci(deps): rebase Go module Dependabot PRs only on request

[devantler]

🤖 Generated by the Agentic Engineer

Why

Every time a Go dependency update merges, Dependabot rebases every other open Go dependency update, and each rebase re-runs the whole CI. Updates parked behind an upstream release can never merge, yet six of them were rebased 53 times between them, filling the organization's shared runners and holding up unrelated work such as the platform's production deploys.

What

Go dependency updates are now rebased only when someone asks for it on the update about to merge, a test fails if that setting is ever dropped, and the maintenance notes say when to ask. Updates already open keep being rebased automatically until they are 30 days old, so the effect builds up over the coming weeks.

🤖 Generated with Claude Code

Part of #7579

👉 After merge/promotion: a conflicting Go dependency update no longer fixes itself; it needs a rebase request before it can merge.

[github-actions]

✅MegaLinter analysis: Success

✅ Linters with no issues

actionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 37 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 642dca45-984f-4932-bb2a-ad63e7a7de8b

📥 Commits

Reviewing files that changed from the base of the PR and between ee5fe39 and 51408f8.

📒 Files selected for processing: 4

• .github/dependabot.yaml
• AGENTS.md
• internal/depcontract/gateway_api_test.go
• internal/depcontract/rebase_strategy_test.go

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code coverage overview

Languages: Go

Go / code-coverage/go

main ffe71ae	claude/dependabot-go... 51408f8	+/-
72%	72%	0%

View coverage of the 5 most impacted files.

File	main ffe71ae	claude/dependabot-go... 51408f8	+/-
pkg/svc/provisi...etzner/token.go	77%	73%	-4%
pkg/svc/install...cd/installer.go	100%	97%	-3%
pkg/cli/cmd/clu...values_drift.go	100%	100%	0%
pkg/cli/cmd/clu...r/reconciler.go	72%	74%	+2%
pkg/cli/cluster...i/distconfig.go	81%	83%	+2%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

[devantler]

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)

Reviewed commit: 51408f82f5af6621e3530f88d9b369584bbe8703

• CodeRabbit: rate limited at this head — command reply 6230288024 ("Review rate limited", 05:40:32Z) and summary 6230288768 ("Review limit reached", 05:40:38Z) answering this PR's request 6230286961; recovers when the free OSS review limit resets.
• Codex: usage limit reached — reply 6230189816 on ksail#7823 (05:29:03Z); the limit is account-wide and recovers at its weekly reset.
• Cursor Bugbot: usage limit reached — reply 6230200017 on ksail#7823 (05:30:20Z); the limit is account-wide and recovers when the usage limit resets.

Scope read: every changed line — the root gomod entry's new rebase-strategy, the dependency contract and its fixtures, the shared Dependabot entry type, and the maintenance note. Checked: rebase-strategy with the value disabled is a key Dependabot accepts on an update entry (SchemaStore's dependabot-2.0 schema lists auto and disabled, default auto), so leaving it out is the regression the contract catches; the contract selects the same root gomod entry the existing Gateway API contract uses, including the directories: ["/"] form; every input it cannot evaluate fails it (no root entry, no updates, unparseable YAML, auto, a missing key), and only an entry that rebases on request passes; the CI path filter for the dependency contracts already covers the Dependabot file and this package, so a change to either runs the contract. Behaviour it does not change: Dependabot still opens and supersedes pull requests on its schedule, and @dependabot rebase still works (Dependabot answered that command after a disclosure line on #6826). Stated limit: pull requests already open keep Dependabot's automatic rebase until they are 30 days old.

Verdict: no P0/P1 findings

[devantler]

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Readiness at 51408f82f5af6621e3530f88d9b369584bbe8703

• Programmatically tested. The new dependency contract failed against the configuration before the setting was added and passes with it; its table covers both entry forms, a missing key, auto, another ecosystem carrying the setting, no root entry, no updates and unparseable YAML. The dependency contracts and the CI harness pass locally (838 tests) and lint is clean. CI at this head: every check settled with no failure, CI - Required Checks green.
• Reviewed. Local review round 5556511825 at this head, clean (all three review lanes rate- or usage-limited, evidence in the review). No review threads, no non-thread findings.
• Evaluated as a user — no exercisable pre-merge surface. This is configuration consumed by Dependabot, which reads it only from the default branch, so nothing can exercise it on this branch. Checked instead: the key and value are ones Dependabot accepts (SchemaStore's dependabot-2.0 schema: auto or disabled), and Dependabot keeps answering @dependabot rebase on request, including after a disclosure line (it did on chore(deps): bump the talos group across 1 directory with 3 updates #6826). Post-merge verification, recorded on A Dependabot refresh wave uses up the shared runners and stalls the platform deploy queue #7579: the next Go update Dependabot opens says automatic rebases are disabled, and a later merge of another Go update does not rebase it.