chore: add Dependabot config and drop the inert legacy CI workflow - #16
Merged
Merged
Conversation
What - Add .github/dependabot.yml (version 2) covering the two ecosystems this repo actually has: npm at "/" (the pnpm workspace root — its single pnpm-lock.yaml covers packages/* too) and github-actions at "/". Nothing for legacy/. - Delete legacy/ci/ci-cd.yml and update legacy/README.md accordingly. Why - Dependabot had no configuration at all, so version updates never ran and security updates arrived one PR per package. The groups below collapse that into one PR per ecosystem for minor+patch and one PR per ecosystem for security fixes; majors stay separate because they need a human. - Right after the legacy/taproot-assets-era removal merged, five "Dependabot Updates" runs failed trying to resolve deleted /legacy/... lockfiles. Scoping the config to the live tree stops that recurring. - legacy/ci/ci-cd.yml was inert (not under .github/workflows, so never executed) and built only deleted code, but it made legacy/ look like a live build surface. It is preserved byte-identical at tag legacy/taproot-assets-era-final (blob 4dc9c28). How verified - Enumerated every manifest on main: git ls-files matched exactly package.json, packages/sdk/package.json, pnpm-lock.yaml and .github/workflows/ci.yml. No Dockerfile, go.mod, Cargo.toml or Python manifests exist. Dependabot alerts API (state=all) returns none. - dependabot.yml validated against the SchemaStore Dependabot 2.0 JSON schema with ajv: PASS. - Confirmed the deleted workflow survives in the tag: blob sha of HEAD:legacy/ci/ci-cd.yml and legacy/taproot-assets-era-final:legacy/ci/ci-cd.yml are both 4dc9c28. - Ran the CI job locally on Node 22.23.1 / pnpm 10.28.2: pnpm install --frozen-lockfile, lint:boundaries (OK), typecheck (clean), test (170 passed, 3 skipped).
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
.github/dependabot.yml(new, version 2) covering the only two ecosystems this repo has:npmat/— the pnpm workspace root. Its singlepnpm-lock.yamlcoverspackages/*, so one entry is the whole JS dependency surface.github-actionsat/.America/Los_Angeles,open-pull-requests-limit: 5, labeldependencies.legacy/— deliberately.legacy/ci/ci-cd.ymland updatedlegacy/README.mdto match.Why
Grouping. With no config, security updates arrive as one PR per package. Each entry declares two groups:
applies-to: version-updates(patterns: ["*"],update-types: [minor, patch]) so routine bumps land as one PR per ecosystem, andapplies-to: security-updates(patterns: ["*"]) so security fixes land as one PR per ecosystem. Majors stay ungrouped — they need a human.Stop the
/legacy/failures. One minute after #15 merged, five "Dependabot Updates" runs failed trying to resolve deleted/legacy/...lockfiles. Scoping the config to the live tree keeps that from recurring.The legacy workflow.
legacy/ci/ci-cd.ymlwas already inert — it is not under.github/workflows/, so GitHub never executed it — but it built only deleted code and madelegacy/read like a live build surface. It is preserved byte-identical under taglegacy/taproot-assets-era-final.How verified
git ls-fileson main matches exactlypackage.json,packages/sdk/package.json,pnpm-lock.yaml,.github/workflows/ci.yml. No Dockerfile,go.mod,Cargo.tomlor Python manifests. The Dependabot alerts API (state=all) returns none.ajv→ PASS.HEAD:legacy/ci/ci-cd.ymlandlegacy/taproot-assets-era-final:legacy/ci/ci-cd.ymlare the same blob,4dc9c28d30b0ff832bc687609954fabb98af8c02.ci.yml):pnpm install --frozen-lockfileOK,lint:boundariesOK (10 files, 1 rule),typecheckclean,test170 passed / 3 skipped.Not changed
No source, no lockfile, no live workflow.
.github/workflows/still contains onlyci.yml.