ci: watch GitHub Actions with Dependabot, excluding setup-roc - #86
Merged
Conversation
Six actions across three workflows had nothing tracking them. Roc packages and the compiler pin stay out of scope: Dependabot has no Roc ecosystem, and nightly-tag is an input value rather than an action version. setup-roc is ignored deliberately. It decides how the compiler is resolved, so a bump could move us off the pinned nightly onto one of the post-2026-08-04 builds that segfault. That deserves its own review with the pin re-verified, not a slot in a grouped bump.
There was a problem hiding this comment.
Pull request overview
Adds a Dependabot configuration to track GitHub Actions versions across the repository’s workflows, while deliberately excluding roc-lang/setup-roc to avoid accidental compiler-resolution changes during routine CI maintenance.
Changes:
- Introduce
.github/dependabot.ymlfor thegithub-actionsecosystem with a weekly schedule and a cap of 3 open PRs. - Group first-party actions (
actions/*,github/*) into a single Dependabot PR. - Ignore updates for
roc-lang/setup-rocto keep compiler resolution changes manual and intentionally reviewed.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+15
to
+16
| # `ci:` produces no release; a routine action bump must never move the version | ||
| prefix: ci |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.
Suppressed comments (1)
.github/dependabot.yml:16
commit-message.prefixis set toci(no colon), but both the inline comment and the PR description rely onci:as a Conventional Commit type. Without the colon, Dependabot will produce commit messages likeci Bump ..., which won't match Conventional Commits and may be parsed unpredictably by release-please.
Set the prefix to a valid Conventional Commit prefix (e.g. ci:) and quote it so YAML parses it correctly.
# `ci:` produces no release; a routine action bump must never move the version
prefix: ci
Use the documented prefix+scope form so the message is a valid Conventional Commit whether or not Dependabot appends the colon itself. Type stays ci, which produces no release.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Six actions across three workflows currently have nothing tracking them:
actions/checkout@v7,upload-artifact@v7,download-artifact@v8,taiki-e/install-action@v2,googleapis/release-please-action@v4androc-lang/setup-roc@v0.3.0. There was nodependabot.ymlat all.Scope, and what stays out
Only the
github-actionsecosystem, because that is the only one that applies here:basic-cli 0.21andhttp 1.0.0are content-addressed tarball URLs in the app header — the version and a BLAKE3 hash are both part of the URL. No generic tool bumps those.nightly-tag: nightly-2026-August-04-1cb06bcis an input to setup-roc, not an action version, so Dependabot never sees it.Why setup-roc is ignored
It decides how the compiler is resolved. A bump past v0.3.0 could change the default channel or the meaning of
nightly-tagand quietly move us off the pinned nightly — onto one of the post-2026-08-04 builds that segfault (#83, roc-lang/roc#10693).CI would catch it, since
roc test src/Render.rocis exactly what dies there. But that is not a change anyone should review in a batch alongside acheckoutbump. Ignored here so it stays a deliberate update with the pin re-verified.Details
Weekly on Monday, capped at 3 open PRs. First-party
actions/*are grouped into one PR. Commit prefix isci:, so a routine action bump never triggers a release.