ci: watch the action versions with dependabot - #28
Merged
Conversation
The node20 runtime deprecation in #25 was found by reading a job log. Nothing watched the action versions pinned in .github/workflows/, so they had gone a full major behind before anything said so. Every action is grouped into a single PR, so a quiet week opens none and a week where three actions cut releases still costs one review. The commit prefix matches the conventional-commit style already in the log. Only the github-actions ecosystem. Pointing dependabot at npm is a separate decision about PR volume and lockfile churn on a tree that includes lighthouse and puppeteer-core, and it should be made on its own rather than as a side effect of this. Closes #27
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #27.
#25 was found by reading a job log. Nothing watched the action versions pinned in
.github/workflows/, soactions/checkoutandactions/setup-nodehad gone a full major behind before a deprecation notice made it visible. This adds.github/dependabot.ymlso the next one arrives as a PR instead.Config choices
directory: /github-actionsecosystem this means the whole repository, and is what covers.github/workflows/. It is not a claim that workflows live at the root.groups.actions.patterns: ['*']commit-message.prefix: cigit log.schedule.interval: weeklyBehaviour changes
None in the package or in CI. This file is read by Dependabot on GitHub's side and by nothing in the build — no workflow, test, or published artifact reads it. The visible effect is future PRs authored by the bot.
Deliberately not included
The
npmecosystem. This repo pins a real dependency tree (lighthouse,puppeteer-core), and turning Dependabot loose on it is a separate decision about PR volume and lockfile churn — worth making on its own. It is a few lines in the same file whenever you want it.Verification
The config parses to the expected shape (checked with
js-yaml).npm run lint,npm test(594 passed),npm run generate-typesandnpm run check-typesall pass, though none of them read this file. The real confirmation is GitHub's own: after merge, Insights -> Dependency graph -> Dependabot should list agithub-actionsentry with a last-checked timestamp and no config error. A malformed file surfaces there rather than failing a CI job, so it is worth a look once this lands.