chore(ci): pin dependabot to dev, drop npm updates, bump prettier - #515
Merged
Conversation
- Add target-branch: dev to github-actions block. Without it, dependabot derives the base from the repo default (main) and resets it on every rebase, so a manual PR retarget can never stick (observed on #503, #512). - Drop the npm package-ecosystem block entirely. package.json has no runtime dependencies -- only 3 devDependencies (husky, lint-staged, prettier) that never reach a user, since flow-cli ships as zsh through Homebrew. Of the last 16 npm dependabot PRs, 9 were closed unmerged and only 6 merged, each costing a full CI run (ZSH Plugin Tests ~7min). github-actions updates merged 3/3 and cover real security surface (e.g. #444 bumped actions/create-github-app-token, later hardened by #514). - Bump prettier 3.9.4 -> 3.9.6 by hand (same version #503 proposed), superseding #503 -- closed as no longer needed. Verified: prettier --check against this branch and against origin/dev produce identical pre-existing warnings/errors (archive docs, test fixtures) -- nothing newly introduced by this change.
Data-Wise
added a commit
that referenced
this pull request
Sep 5, 2026
Version bump for the 5 commits merged to dev since 7.17.1: 2 fixes (#513 PATH, #499 tap-push GH006), 3 CI/deps changes (#512, #514, #515). No feat commits -- patch bump. - package.json, package-lock.json, flow.plugin.zsh (FLOW_VERSION), CLAUDE.md, man/man1/*.1 (.TH version line) via scripts/release.sh - CHANGELOG.md + docs/CHANGELOG.md: new 7.17.2 entry (mirrored, per the project's dual-changelog convention) - docs/index.md: footer version stamp only. The "What's New in v7.17.1" banner is left as-is -- it describes actual 7.17.1 user-facing features, and 7.17.2 has none to add (pure CI/infra). Test-run side effects (.STATUS wins/streak counters, a test fixture's timestamp) surfaced as unrelated dirty files from running ./tests/run-all.sh and were excluded from this commit.
Merged
Data-Wise
added a commit
that referenced
this pull request
Sep 5, 2026
.STATUS had not been touched since 2026-07-07 (f740eb5): the header still read Phase: Released (v7.16.0) while v7.17.0, v7.17.1 and v7.17.2 had all shipped, and Focus: held the literal string "--help" -- a bad write, not a focus. - Header: Phase -> Released (v7.17.2); Focus -> a real one-line focus. - Added four session entries reconstructed from CHANGELOG.md, the merged PR bodies (#505, #506, #509, #513, #499, #514, #515) and the release tags: v7.17.0 (teach deploy safety + CI coverage), v7.17.1 (alias-proof pipelines), v7.17.2 (CI hardening + PATH fix), plus the 2026-07-08..07-19 housekeeping commits and a session entry for this resync itself. - Demoted the stale "Current Session (2026-07-07)" and two older headings that had been left as "Current Session" against the file's own convention. - Test baseline refreshed from evidence rather than carried forward: 84 passed / 0 failed / 0 timeout / 1 skipped across 85 registered suites, per CI run 33946019980 on dev. - Next Action re-verified against repo state: added stale-issue triage (#487/#488/#489), the PR #500 rebase decision, .gitignore for .token-optimizer, and the advisory markdown-lint backlog. Verified: scripts/check-status.zsh clean on the updated file (validator confirmed non-vacuous via a planted "Progress: banana" defect, which it caught); _flow_status_field reads all four header fields correctly. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Data-Wise
added a commit
that referenced
this pull request
Sep 6, 2026
…timizer/ Session log entry for the work done after this morning's resync, plus a Next Action list re-verified against the resulting repo state. What the entry records (each verified against git/gh, not .STATUS): - PR #500 merged (c607a14) after 6 weeks stuck. It was based on main, predating #515's target-branch key. "@dependabot recreate" retargeted it to dev -- so target-branch is NOT creation-time-only, and a mis-based dependabot PR can be rescued rather than closed and waited out. - Issues #489 and #488 closed with evidence (PR #496, merge commit 94d9bde, code live at zsh/functions.zsh:620 and :638). - Issue #487 rewritten, not closed: the AI rewrite trigger was never built and never rejected, and its spec is unrecoverable because the branch holding it was never pushed. The surviving copy of its decisions was the GitHub issue body, not git. - 9 stale remote feature/* branches: 8 deleted after passing both gates (remote tip == PR headRefOid, and the PR merge commit is an ancestor of dev); feature/email-dispatcher-restructure kept, since it is the only copy of a 96-line ORCHESTRATE plan. - Tooling friction worth remembering: branch-guard blocked a provably-safe push --delete (the cc-config#32 false positive), and the auto-mode classifier blocked a deletion loop while allowing the same deletions individually. .gitignore: .token-optimizer/ is a per-machine plugin cache. Also restores the ## Parked section, which an over-broad regex removed while rewriting ## Next Action in the same pass. Verified: scripts/check-status.zsh clean; _flow_status_field reads Phase, Focus and Progress correctly. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
target-branch: devto the github-actions dependabot block.Why
Dependabot derives its PR base from the repo default (
main) whenever notarget-branchis set, and resets it back tomainon every rebase —confirmed live on #503: retargeted to
dev, requested a rebase, basereset to
mainagain with a new head commit. A manual per-PR retargetcan never stick against this.
npm updates are dropped rather than just retargeted:
package.jsonhasno runtime
dependencies, only 3 devDependencies (husky, lint-staged,prettier) that never reach a user — flow-cli ships as zsh through
Homebrew. Of the last 16 npm dependabot PRs, 9 were closed unmerged and
only 6 merged, each costing a full CI run (ZSH Plugin Tests alone ~7min).
github-actions updates merged 3/3 and cover real security surface (e.g.
#444 bumped
actions/create-github-app-token, later hardened by #514) —kept, now correctly targeting
dev.Supersedes
Closes #503 (prettier 3.9.4→3.9.6) — same version landed here by hand.
Test plan
.github/dependabot.ymlvalidated withyq(both ecosystem blocksparse,
target-branch: devpresent).npx prettier@3.9.6 --checkrun against this branch and againstorigin/dev(old prettier 3.9.4) — identical set of pre-existingwarnings/errors (archive docs, test fixtures with an invalid YAML
escape); nothing newly introduced by the bump.
coverage required per the repo's pre-PR testing tier table.