From c91756b129b60e4c6c2a0ffce2cb973ca72ce2d3 Mon Sep 17 00:00:00 2001 From: Jarek Potiuk Date: Fri, 28 Aug 2026 18:03:51 +0200 Subject: [PATCH] dependabot: group uv dev tooling and runtime patch/minor bumps Five separate PRs landed on 2026-08-28 (#1208-#1212) for ruff, mypy and types-pyyaml across /pelican and /stash. They are all PEP 735 dev-group tooling that never ships in the published action, so reviewing them one per tool buys nothing. Dependabot opens one PR per directory per group, so this collapses them to one per directory. Runtime dependencies are grouped for patch and minor only - a major bump of something the action ships stays outside every group and keeps its own PR. The allow-list ecosystem stays ungrouped and now says why in a comment. Generated-by: Claude Code (Opus 5) --- .github/dependabot.yml | 26 ++++++++++++++++++++++++++ README.md | 18 ++++++++++++++++++ 2 files changed, 44 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index a1e5407db..5f9a954ab 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -19,6 +19,11 @@ version: 2 updates: + # Deliberately ungrouped: every bump here is an allow-list change that gets + # its own security review and its own `verify` run, and is approved or held + # on its own merits. Grouping would tie an action that fails verification to + # unrelated ones that passed, so a single bad actor would block the batch. + # Do not add a `groups:` key to this ecosystem. - package-ecosystem: "github-actions" # zizmor: ignore[dependabot-cooldown] see #683 and #712 commit-message: prefix: "action-allowlist-review" @@ -64,3 +69,24 @@ updates: interval: "weekly" cooldown: default-days: 7 + groups: + # Lint/test tooling from the PEP 735 `dev` group. These never ship in + # the published action, so reviewing them one PR per tool buys nothing + # — five separate PRs landed on 2026-08-28 (#1208-#1212) for ruff, + # mypy and types-pyyaml across two directories. Dependabot opens one + # PR per directory per group, so this collapses those to two. + dev-tooling: + dependency-type: "development" + patterns: + - "*" + # Runtime dependencies are grouped only for patch and minor bumps. + # A major bump of something the action actually ships stays outside + # every group and so gets its own PR, which is where it belongs: it + # can break consumers and deserves to be reviewed and released alone. + runtime-minor-patch: + dependency-type: "production" + patterns: + - "*" + update-types: + - "minor" + - "patch" diff --git a/README.md b/README.md index b03f70dfc..5eb20dc07 100644 --- a/README.md +++ b/README.md @@ -30,6 +30,7 @@ This repository hosts GitHub Actions developed by the ASF community and approved - [Reviewing](#reviewing) - [Updating Version of Already Approved Action](#updating-version-of-already-approved-action) - [Automated Verification in CI](#automated-verification-in-ci) + - [Dependabot Update Grouping](#dependabot-update-grouping) - [Dependabot Cooldown Period](#dependabot-cooldown-period) - [Manual Version Addition](#manual-addition-of-specific-versions) - [Automatic Expiration of Old Versions](#automatic-expiration-of-old-versions) @@ -333,6 +334,23 @@ Additional flags: > [!NOTE] > **Prerequisites:** `docker` and `uv`. When using the default mode (without `--no-gh`), `gh` (GitHub CLI, authenticated via `gh auth login`) is also required. The build runs in a `node:20-slim` container so no local Node.js installation is needed. +#### Dependabot Update Grouping + +`.github/dependabot.yml` groups updates so that related bumps arrive as one PR: + +| Ecosystem | Group | What it collects | +|---|---|---| +| `github-actions` (`/.github/workflows`, …) | `codeql-action` | `github/codeql-action*` — init/autobuild/analyze must run the same version, so a split PR fails the Analyze jobs | +| `uv` (`/`, `/pelican/`, `/stash/`) | `dev-tooling` | everything in the PEP 735 `dev` group (ruff, mypy, pytest, pylint, `types-*`) — lint/test tooling that never ships in the published action | +| `uv` | `runtime-minor-patch` | patch and minor bumps of runtime dependencies | + +Dependabot opens one PR per directory per group, so `/pelican` and `/stash` each get a single dev-tooling PR rather than one per tool. + +Two things stay deliberately ungrouped: + +- **Major bumps of runtime dependencies** match no group, so each gets its own PR. A major version of something the action ships can break consumers and deserves to be reviewed and released on its own. +- **The allow-list ecosystem** (`/.github/actions/for-dependabot-triggered-reviews`). Every bump there is an allow-list change with its own security review and its own `verify` run, approved or held on its own merits. Grouping would tie an action that fails verification to unrelated ones that passed, so a single bad actor would block the whole batch. + #### Dependabot Cooldown Period This repository uses a [Dependabot cooldown period](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown) of 0 days so that maintainers can review before Dependabot opens a PR on project repositories.