Skip to content

chore: group dependabot updates per ecosystem including security updates #62

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
shenxianpeng wants to merge 1 commit into from
Closed

chore: group dependabot updates per ecosystem including security updates #62

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,10 @@ updates:
npm-deps:
patterns:
- "*"
npm-deps-security:
applies-to: security-updates
patterns:
- "*"
Comment on lines +13 to +16

@coderabbitai coderabbitai Bot Aug 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

repo="$(gh repo view --json nameWithOwner --jq .nameWithOwner)"

gh pr list \
  --repo "$repo" \
  --state open \
  --limit 100 \
  --json number,title,headRefName,author \
  | jq '[.[] | select(.author.login | test("dependabot"; "i"))]'

Repository: devops-maturity/spec

Length of output: 1298

Grouped security-update changes can close existing Dependabot PRs.

GitHub may replace existing security-update pull requests when grouped security updates are enabled. If the rollout plan depends on preserving PRs such as the current open npm-deps group update, update the plan to accommodate grouped replacements.

Also applies to: 25-28

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/dependabot.yml around lines 13 - 16, Update the Dependabot rollout
plan to account for grouped security updates replacing or closing existing
security-update pull requests, including the current npm-deps group update.
Preserve the npm-deps-security configuration while documenting or adjusting the
plan for these grouped replacements.

- package-ecosystem: github-actions
directory: /
schedule:
Expand All @@ -18,3 +22,19 @@ updates:
github-action-deps:
patterns:
- "*"
github-action-deps-security:
applies-to: security-updates
patterns:
- "*"
- package-ecosystem: docker
directory: /
schedule:
interval: quarterly
groups:
docker-deps:
patterns:
- "*"
docker-deps-security:
applies-to: security-updates
patterns:
- "*"