From 6076c57e435557c4089f31fe788ead97f6ea6cc4 Mon Sep 17 00:00:00 2001 From: mariano Date: Sat, 8 Aug 2026 16:59:12 -0500 Subject: [PATCH 1/2] ci: watch GitHub Actions with Dependabot, excluding setup-roc Six actions across three workflows had nothing tracking them. Roc packages and the compiler pin stay out of scope: Dependabot has no Roc ecosystem, and nightly-tag is an input value rather than an action version. setup-roc is ignored deliberately. It decides how the compiler is resolved, so a bump could move us off the pinned nightly onto one of the post-2026-08-04 builds that segfault. That deserves its own review with the pin re-verified, not a slot in a grouped bump. --- .github/dependabot.yml | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..3859903 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,29 @@ +# GitHub Actions only. Dependabot has no Roc ecosystem, so it cannot see the platform and +# package tarballs in src/app.roc (their version AND content hash are baked into the URL), +# and it cannot see the compiler pin either — `nightly-tag:` is an INPUT to setup-roc, not +# an action version. Bumping the nightly stays a manual, tested decision; see +# docs/roc-new-compiler-notes.md for why that matters right now. +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + day: monday + open-pull-requests-limit: 3 + commit-message: + # `ci:` produces no release; a routine action bump must never move the version + prefix: ci + groups: + # Routine first-party actions travel together — one PR, one review. + github-official: + patterns: + - actions/* + - github/* + ignore: + # setup-roc decides HOW the compiler is resolved. A bump could change the default + # channel or the meaning of nightly-tag and silently move us off the pinned nightly — + # onto one that segfaults, as every nightly after 2026-08-04 currently does. CI would + # catch it (roc test src/Render.roc is what dies), but this is not a change to review + # in a batch with a checkout bump. Update it deliberately, with the pin re-verified. + - dependency-name: roc-lang/setup-roc From c178e0586de9405e97a440051d680c77a03fb2c6 Mon Sep 17 00:00:00 2001 From: mariano Date: Sat, 8 Aug 2026 17:16:10 -0500 Subject: [PATCH 2/2] ci: make the Dependabot commit prefix unambiguous Use the documented prefix+scope form so the message is a valid Conventional Commit whether or not Dependabot appends the colon itself. Type stays ci, which produces no release. --- .github/dependabot.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 3859903..d514085 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -12,8 +12,11 @@ updates: day: monday open-pull-requests-limit: 3 commit-message: - # `ci:` produces no release; a routine action bump must never move the version + # Yields `ci(deps): bump ...` — the form GitHub documents, so it is a valid + # Conventional Commit whether or not Dependabot appends the colon itself. Type `ci` + # produces no release: a routine action bump must never move the version. prefix: ci + include: scope groups: # Routine first-party actions travel together — one PR, one review. github-official: