chore: group dependabot updates per ecosystem including security updates - #62
chore: group dependabot updates per ecosystem including security updates#62shenxianpeng wants to merge 1 commit into
Conversation
- npm / github-actions: keep existing version-update groups, add applies-to: security-updates groups so security bumps are also batched instead of one PR per dependency (e.g. #59-#61) - add missing docker ecosystem (covers Dockerfile and Dockerfile.dev base images) with version-update and security-update groups
✅ Deploy Preview for devops-maturity-spec ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
📝 WalkthroughWalkthroughDependabot now groups npm and GitHub Actions security updates separately. It also configures quarterly Docker dependency and security-update scans from the repository root. ChangesDependabot update policy
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/dependabot.yml:
- Around line 13-16: Update the Dependabot rollout plan to account for grouped
security updates replacing or closing existing security-update pull requests,
including the current npm-deps group update. Preserve the npm-deps-security
configuration while documenting or adjusting the plan for these grouped
replacements.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 5b429591-15d2-4f90-b451-418cd320a2bf
📒 Files selected for processing (1)
.github/dependabot.yml
| npm-deps-security: | ||
| applies-to: security-updates | ||
| patterns: | ||
| - "*" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
repo="$(gh repo view --json nameWithOwner --jq .nameWithOwner)"
gh pr list \
--repo "$repo" \
--state open \
--limit 100 \
--json number,title,headRefName,author \
| jq '[.[] | select(.author.login | test("dependabot"; "i"))]'Repository: devops-maturity/spec
Length of output: 1298
Grouped security-update changes can close existing Dependabot PRs.
GitHub may replace existing security-update pull requests when grouped security updates are enabled. If the rollout plan depends on preserving PRs such as the current open npm-deps group update, update the plan to accommodate grouped replacements.
Also applies to: 25-28
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/dependabot.yml around lines 13 - 16, Update the Dependabot rollout
plan to account for grouped security updates replacing or closing existing
security-update pull requests, including the current npm-deps group update.
Preserve the npm-deps-security configuration while documenting or adjusting the
plan for these grouped replacements.
1 participant
Summary
Group Dependabot updates per package ecosystem, including security updates.
Background / root cause
The config already had
groupsfor npm (npm-deps) and github-actions (github-action-deps), but only for version updates — Dependabot'sgroupsdefault toapplies-to: version-updates, and security updates are never grouped unless explicitly opted in. That is why #59 (immutable), #60 (postcss) and #61 (fast-uri) each got their own PR: they are security updates (GHSA advisories, see the open Dependabot alerts) and were outside the existing groups.Also, the repo has
Dockerfile+Dockerfile.devbut no docker ecosystem entry at all, so base-image updates were never tracked.Changes
.github/dependabot.yml:npm-deps(version updates), addnpm-deps-securitywithapplies-to: security-updatesgithub-action-deps, addgithub-action-deps-securitydirectory: /covers bothDockerfileandDockerfile.dev(Dependabot scans all files matching the Dockerfile pattern), withdocker-deps+docker-deps-securitygroupsResult
Going forward, each ecosystem gets:
Existing open PRs (#57, #59–#61) are unaffected; future updates will use the groups.
Validated: YAML parses; groups per ecosystem: npm [npm-deps, npm-deps-security], github-actions [github-action-deps, github-action-deps-security], docker [docker-deps, docker-deps-security].
Summary by CodeRabbit