Skip to content

ci(ci): group Dependabot updates and stop linting its own commits #182

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MarTrepodi merged 2 commits into from
Oct 13, 2026
Merged

ci(ci): group Dependabot updates and stop linting its own commits #182

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8440cf3
ci(ci): group Dependabot updates and stop linting its own commits
MarTrepodi Oct 13, 2026
51e7f7b
Merge branch 'develop' into ci/dependabot-groups
MarTrepodi Oct 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,10 @@
version: 2

# Dependabot reads this file from the DEFAULT branch (main), not from target-branch, so
# edits take effect only once they are released to main.
#
# Updates are grouped (one PR per group per week, not one per dependency), and the commit
# prefix is pinned so Dependabot doesn't guess a type/scope from repo history.
updates:
- package-ecosystem: "github-actions"
directory: "/"
Expand All @@ -8,6 +14,11 @@ updates:
labels:
- "dependencies"
- "ci"
commit-message:
prefix: "chore(deps)"
groups:
github-actions:
patterns: ["*"]

# "uv" (not "pip") so updates also refresh uv.lock
- package-ecosystem: "uv"
Expand All @@ -18,3 +29,13 @@ updates:
open-pull-requests-limit: 10
labels:
- "dependencies"
commit-message:
prefix: "chore(deps)"
groups:
# ruff and ty bumps routinely bring new lint/type diagnostics that need code fixes;
# keep them apart so they can't hold up the routine bumps. A dependency joins the
# FIRST group it matches, so this must stay above the catch-all.
astral-tools:
patterns: ["ruff", "ty"]
python:
patterns: ["*"]
11 changes: 11 additions & 0 deletions .github/workflows/commitlint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,17 @@ jobs:
# non-conventional squash) commits — those are already on main and are
# not this PR's responsibility to police.
commits="$(git rev-list --no-merges --reverse "${base}..${head}" --not FETCH_HEAD)"
# Dependabot copies its subject casing from repo history rather than from
# dependabot.yml, so its "chore(deps): Bump ..." can fail subject-case. Its own
# commits are machine-generated and never reach the changelog, so skip them —
# but only on PRs Dependabot opened, so a forged author elsewhere is still
# linted, and any human commit pushed onto a Dependabot PR still is too.
if [ "${{ github.event.pull_request.user.login }}" = "dependabot[bot]" ]; then
bot="49699333+dependabot[bot]@users.noreply.github.com"
commits="$(git rev-list --no-merges --reverse --no-commit-header --format='%H %ae' \
"${base}..${head}" --not FETCH_HEAD | awk -v bot="${bot}" '$2 != bot { print $1 }')"
echo "Dependabot PR: skipping commits authored by ${bot}."
fi
if [ -z "${commits}" ]; then
echo "No PR-unique commits to lint (mergeback/back-merge or merge-only PR)."
exit 0
Expand Down
Loading