From 9ad53eb7392e8de3f8e5f6f16d2665ec339e3aa9 Mon Sep 17 00:00:00 2001 From: Dave Mihalcik Date: Tue, 20 Oct 2026 16:43:32 -0400 Subject: [PATCH] chore(ci): give Dependabot PRs conventional commit titles Dependabot's default chore(deps) and chore(deps-dev) titles fail the PR title check because deps and deps-dev are not allowed scopes. Configure commit-message prefixes so runtime dependency bumps use fix(main), which release-please turns into a patch release, and development dependency bumps use chore(ci). open-pull-requests-limit: 0 keeps version updates off, so Dependabot still only opens security update PRs; those pick up the prefixes too. Signed-off-by: Dave Mihalcik --- .github/dependabot.yml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..14a940fb --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,28 @@ +# dependabot.yml +# +# Documentation: +# https://docs.github.com/code-security/dependabot/working-with-dependabot/dependabot-options-reference +# +# Dependabot only opens security update PRs here; open-pull-requests-limit: 0 +# turns off version updates. Security update PRs still use the commit-message +# settings, which keep their titles within the scopes allowed by the PR title +# check in workflows/checks.yaml. + +version: 2 +updates: + - package-ecosystem: maven + directories: + - / + - /cmdline + - /examples + - /sdk + - /sdk-fips-bc + - /sdk-pqc-bc + schedule: + interval: weekly + open-pull-requests-limit: 0 + commit-message: + # Runtime dependencies ship in released artifacts, so cut a patch release. + prefix: "fix(main)" + # Test-scoped dependencies don't change released artifacts. + prefix-development: "chore(ci)"