From 5de6b4d2acae9f09f0b07d15b79c3635abfa53fa Mon Sep 17 00:00:00 2001 From: Marco Walz Date: Fri, 18 Sep 2026 13:14:23 +0200 Subject: [PATCH] ci: enable grouped dependabot npm updates There is no `.github/dependabot.yml` today, so dependabot runs security updates only and those bump one package at a time. Astro releases `astro` and `@astrojs/*` in lockstep with narrow peer ranges, so a single-package bump inside that family can fail to resolve. #380 (astro 7.1.6 -> 7.2.8) happens to resolve, because the peer that breaks this is optional here: astro peers `@astrojs/markdown-remark` optionally, and this repo has no `@astrojs/mdx` or Starlight to materialise it. That is luck about our dependency surface, not a property of the family. dfinity/developer-docs hit the same shape twice and had to take both over by hand. Three groups: - `astro` / `astro-security` -- `astro` + `@astrojs/*` in one PR, so dependabot resolves the family in a single pass. - `rest` -- everything else in one PR, so the weekly run stays at two PRs. Deliberately not grouped: `preact` (@astrojs/preact peers it at ^10.6.5, a wide range, so it is not lockstep) and `sharp` (an optional dep of astro at ^0.35.4; #381 bumped it alone and resolved fine). Grouping fixes resolution, not code. A grouped PR still fails the build check whenever the new version needs source changes; those get taken over by hand. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..bfd76d5e --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,40 @@ +version: 2 + +updates: + # Version updates exist so that lockstep families can be bumped together. + # Without them dependabot runs security updates only, and those touch one + # package at a time: an astro security bump on its own may not resolve, + # because astro pins its @astrojs/* peers to a narrow range. + - package-ecosystem: npm + directory: "/" + schedule: + interval: weekly + day: monday + open-pull-requests-limit: 5 + commit-message: + prefix: "chore(deps)" + groups: + # astro and @astrojs/* release in lockstep; one PR per family so + # dependabot resolves them in a single pass. + astro: + applies-to: version-updates + patterns: + - "astro" + - "@astrojs/*" + # Only coalesces family members that each carry an advisory, so a single + # astro advisory still arrives as a one-package PR that may not resolve. + # The weekly version update above is what keeps that rare; when one does + # show up, take it over by hand. + astro-security: + applies-to: security-updates + patterns: + - "astro" + - "@astrojs/*" + # Everything else in one PR, to keep the weekly run to two PRs. + rest: + applies-to: version-updates + patterns: + - "*" + exclude-patterns: + - "astro" + - "@astrojs/*"