ci(deps): add dependabot config with grouped docs lockfile updates - #356
Merged
Conversation
There was no .github/dependabot.yml, so Dependabot ran on defaults and opened one PR per package against docs/package-lock.json. Twelve such PRs accumulated; they conflicted with each other and with hand-written lockfile work (#342), and each merge forced the rest to rebase. Three were already redundant by the time they were reviewed. Group all docs npm minor/patch bumps into a single weekly PR so the lockfile is only rewritten once per cycle, and cap concurrent PRs at 3. Majors stay ungrouped so they still get individual review. Also groups github-actions bumps, which are low volume. Note the docs site is `private: true` and never published, so these are build-time dependencies only.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
There is no
.github/dependabot.ymlin the repo, so Dependabot has been running on defaults: one PR per package against a single ~30k-linedocs/package-lock.json.That produced the mess untangled today — twelve open docs PRs that conflicted with each other and with the hand-written lockfile refresh in #342. Each merge put the rest
BEHIND, and three (#353, #354, #355) turned out to be no-ops by the time they were looked at, because #342 had already carried their target versions.What this does
/docsnpm minor + patch bumps into one PR per week (Mondays), so the lockfile is rewritten once per cycle instead of once per package.github-actionsbumps too — low volume, but same reasoning.build(deps)/ci(deps)commit prefixes to match existing history, and addsdependencieslabels.Scope note
docs/package.jsonisprivate: trueand never published, so everything grouped here is build-time only and never reaches users of the Python package. That's what makes weekly batching the right tradeoff rather than per-package immediacy.Validated: the YAML parses and both ecosystem entries resolve as expected.