Skip to content

ci: add npm and pre-commit ecosystems to Dependabot #369

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Aureliolo merged 6 commits into from
Mar 14, 2026
Merged

ci: add npm and pre-commit ecosystems to Dependabot #369

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
fd2373c
ci: add npm and pre-commit ecosystems to Dependabot
Aureliolo Mar 14, 2026
029640f
fix: address 6 PR review findings from local agents and external revi…
Aureliolo Mar 14, 2026
5450ce4
fix: reorder checkout before artifact download in deploy-preview
Aureliolo Mar 14, 2026
1c3ea3e
ci: allow sharp AND-compound licenses in dependency review
Aureliolo Mar 14, 2026
11190a6
fix: checkout wrangler lockfile from main, not PR head
Aureliolo Mar 14, 2026
5f10cc0
fix: pin sharp PURL versions and add explicit ref: main to checkout
Aureliolo Mar 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 53 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,59 @@ updates:
labels:
- type:ci

- package-ecosystem: pre-commit
directory: /
schedule:
interval: daily
time: "06:00"
timezone: Etc/UTC
commit-message:
prefix: "chore"
groups:
minor-and-patch:
update-types: [minor, patch]
open-pull-requests-limit: 5
reviewers:
- Aureliolo
labels:
- type:chore

- package-ecosystem: npm
directories:
- /web
- /site
schedule:
interval: daily
time: "06:00"
timezone: Etc/UTC
commit-message:
prefix: "chore"
groups:
minor-and-patch:
update-types: [minor, patch]
open-pull-requests-limit: 10
reviewers:
- Aureliolo
labels:
- type:chore
Comment on lines +55 to +72
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot Mar 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

For better separation of concerns and future flexibility, consider splitting this npm configuration into two separate blocks: one for application dependencies (/web, /site) and another for CI tooling dependencies (/.github).

This would allow you to apply different settings to each group. For example, the suggested change below:

  • Uses a more specific label type:ci for the /.github dependencies, which would be consistent with your github-actions configuration.
  • Sets a separate open-pull-requests-limit for each group, which can be tuned independently in the future.
  - package-ecosystem: npm
    directories:
      - /web
      - /site
    schedule:
      interval: daily
      time: "06:00"
      timezone: Etc/UTC
    commit-message:
      prefix: "chore"
    groups:
      minor-and-patch:
        update-types: [minor, patch]
    open-pull-requests-limit: 10
    reviewers:
      - Aureliolo
    labels:
      - type:chore

  - package-ecosystem: npm
    directory: /.github
    schedule:
      interval: daily
      time: "06:00"
      timezone: Etc/UTC
    commit-message:
      prefix: "chore"
    groups:
      minor-and-patch:
        update-types: [minor, patch]
    open-pull-requests-limit: 5
    reviewers:
      - Aureliolo
    labels:
      - type:ci


- package-ecosystem: npm
directory: /.github
schedule:
interval: daily
time: "06:00"
timezone: Etc/UTC
commit-message:
prefix: "ci"
groups:
minor-and-patch:
update-types: [minor, patch]
open-pull-requests-limit: 5
reviewers:
- Aureliolo
labels:
- type:ci

- package-ecosystem: docker
directory: /docker/backend
schedule:
Expand Down
Loading
Loading