From 1c9687e40e57285fe224301522fc7f34ed2489b4 Mon Sep 17 00:00:00 2001 From: Vincent Biret Date: Thu, 17 Sep 2026 14:28:22 -0400 Subject: [PATCH] ci: switches to a dedicated solution for dependabot --- .github/dependabot.yml | 11 +-- dotnet/dependabot/README.md | 9 ++ .../agent-framework-dependabot.slnx | 96 +++++++++++++++++++ 3 files changed, 109 insertions(+), 7 deletions(-) create mode 100644 dotnet/dependabot/README.md create mode 100644 dotnet/dependabot/agent-framework-dependabot.slnx diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 2664f71d40..aaa1d81bc1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,13 +7,10 @@ version: 2 updates: # Maintain dependencies for nuget - package-ecosystem: "nuget" - directory: "dotnet/" - # The samples tree contains most of the .NET package manifests and causes - # the NuGet updater to exceed Dependabot's fixed execution timeout. Keep the - # production source, tests, and central package versions in scope so updates - # can be opened again. - exclude-paths: - - "samples/**" + # Use the Dependabot-only solution in this folder so NuGet discovery does + # not expand the full developer solution, which includes samples and times + # out before creating update PRs. + directory: "dotnet/dependabot/" schedule: interval: "cron" cronjob: "0 8 * * 4,0" # Every Thursday(4) and Sunday(0) at 8:00 UTC diff --git a/dotnet/dependabot/README.md b/dotnet/dependabot/README.md new file mode 100644 index 0000000000..9f1c772458 --- /dev/null +++ b/dotnet/dependabot/README.md @@ -0,0 +1,9 @@ +# Dependabot NuGet discovery + +This folder contains the NuGet entry point used by Dependabot. + +Dependabot's NuGet updater expands solution files before resolving package updates. The developer solution in `dotnet/agent-framework-dotnet.slnx` includes the sample projects, and expanding those projects causes the updater to exceed its fixed execution timeout before it can open dependency update pull requests. + +`agent-framework-dependabot.slnx` intentionally references only non-sample source and test projects. The referenced projects still live under `dotnet/src` and `dotnet/tests`, so MSBuild imports the central package management configuration from `dotnet/Directory.Packages.props` normally. + +Do not add sample projects to this solution. If a new non-sample project should be covered by Dependabot NuGet updates, add it here. diff --git a/dotnet/dependabot/agent-framework-dependabot.slnx b/dotnet/dependabot/agent-framework-dependabot.slnx new file mode 100644 index 0000000000..4591ba0f06 --- /dev/null +++ b/dotnet/dependabot/agent-framework-dependabot.slnx @@ -0,0 +1,96 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +