From 59b71ed0e2df55544dd5261194c6348159beae38 Mon Sep 17 00:00:00 2001 From: Cat5Dog2 Date: Wed, 5 Aug 2026 10:58:33 +0900 Subject: [PATCH 1/2] build: centralize package versions with CPM Moves all PackageVersion entries into a root Directory.Packages.props and strips the inline versions from the three project files. The drift this repo just hit was cross-project: Web.Tests sat on Test SDK 18.6.0 while E2ETests was on 18.7.0, and nothing in the build objected. Under CPM that state is unrepresentable, because the version exists in exactly one place. Dependabot grouping reduces how often the versions are allowed to diverge; CPM removes the ability to express the divergence at all. They address the same failure from different ends. Versions are written as literals rather than shared MSBuild properties, which departs from the usual CPM style. A $(Var) indirection is only worth having if Dependabot can resolve and rewrite it, and if it cannot, the failure is the silent one this whole exercise is about: no PR gets opened and nothing announces that. Keeping ASP.NET Core and EF Core moving together is already handled by the aspnetcore-efcore group, so the indirection buys little and risks a lot. Resolved versions are unchanged from the previous commit: verified with dotnet list package across all three projects. Build clean, 240 unit tests, 8 Playwright E2E tests, dotnet format --verify-no-changes. Co-Authored-By: Claude Opus 5 --- Directory.Packages.props | 45 +++++++++++++++++++ .../PetHealthManagement.Web.csproj | 22 ++++----- .../PetHealthManagement.Web.E2ETests.csproj | 14 +++--- .../PetHealthManagement.Web.Tests.csproj | 16 +++---- 4 files changed, 71 insertions(+), 26 deletions(-) create mode 100644 Directory.Packages.props diff --git a/Directory.Packages.props b/Directory.Packages.props new file mode 100644 index 0000000..57dc5f6 --- /dev/null +++ b/Directory.Packages.props @@ -0,0 +1,45 @@ + + + + true + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/PetHealthManagement.Web/PetHealthManagement.Web.csproj b/src/PetHealthManagement.Web/PetHealthManagement.Web.csproj index 2d50b39..b87fc71 100644 --- a/src/PetHealthManagement.Web/PetHealthManagement.Web.csproj +++ b/src/PetHealthManagement.Web/PetHealthManagement.Web.csproj @@ -8,17 +8,17 @@ - - - - - - - - - - - + + + + + + + + + + + diff --git a/tests/PetHealthManagement.Web.E2ETests/PetHealthManagement.Web.E2ETests.csproj b/tests/PetHealthManagement.Web.E2ETests/PetHealthManagement.Web.E2ETests.csproj index 5932fd7..56e40a1 100644 --- a/tests/PetHealthManagement.Web.E2ETests/PetHealthManagement.Web.E2ETests.csproj +++ b/tests/PetHealthManagement.Web.E2ETests/PetHealthManagement.Web.E2ETests.csproj @@ -15,13 +15,13 @@ - - - - - - - + + + + + + + diff --git a/tests/PetHealthManagement.Web.Tests/PetHealthManagement.Web.Tests.csproj b/tests/PetHealthManagement.Web.Tests/PetHealthManagement.Web.Tests.csproj index b425633..1c757e6 100644 --- a/tests/PetHealthManagement.Web.Tests/PetHealthManagement.Web.Tests.csproj +++ b/tests/PetHealthManagement.Web.Tests/PetHealthManagement.Web.Tests.csproj @@ -15,14 +15,14 @@ - - - - - - - - + + + + + + + + From 425ea6615518e2321e510da25cba46c48c5badeb Mon Sep 17 00:00:00 2001 From: Cat5Dog2 Date: Wed, 5 Aug 2026 10:58:47 +0900 Subject: [PATCH 2/2] build: widen Dependabot's scan and group the release trains Three changes to the nuget ecosystem, plus a correction to an earlier claim of mine. Scan directories gain "/". Both the CPM manifest added in the previous commit and the existing dotnet-tools.json live at the repository root, which /src/** and /tests/** do not cover. This, not a gap in Dependabot, is why dotnet-ef sat on 10.0.9 while EF Core moved: Dependabot has discovered and analyzed dotnet-tools.json since 2024 (dependabot-core#8889 and #10269). An earlier commit message in this branch stated the opposite and was wrong. Grouping ASP.NET Core, EF Core and dotnet-ef together is the substantive fix. They ship as one train, and splitting them into separate PRs is what let Design/Tools drift ahead of SqlServer. Major bumps stay ungrouped so something like ImageSharp 3.x to 4.0 still lands on its own. The limit goes from five to ten. At the limit Dependabot defers opening the remaining PRs to a later run rather than dropping them, but nothing reports the deferral, so four packages sat on 10.0.9 with no PR and no signal. github-actions is deliberately left ungrouped. Dependabot already emits one PR per action across every workflow that uses it, which is what #130 did for setup-dotnet across five files, so a group adds nothing there while making unrelated major bumps share a PR and a CI failure. Co-Authored-By: Claude Opus 5 --- .github/dependabot.yml | 42 ++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 40 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 2efab05..ca511db 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -2,6 +2,10 @@ version: 2 updates: - package-ecosystem: "nuget" directories: + # リポジトリ直下には CPM の Directory.Packages.props と、ローカルツール + # マニフェスト dotnet-tools.json がある。"/" が無いとどちらも探索対象外になる。 + # dotnet-ef が 10.0.9 に取り残されていたのはこれが原因。 + - "/" - "/src/**" - "/tests/**" schedule: @@ -10,10 +14,40 @@ updates: time: "09:00" timezone: "Asia/Tokyo" target-branch: "main" - open-pull-requests-limit: 5 + # 枠が埋まると更新 PR の作成が次回以降に先送りされ、しかもそれが通知されない。 + # 実際 EFCore.SqlServer 等の 10.0.10 は長期間 PR 化されていなかった。 + open-pull-requests-limit: 10 commit-message: prefix: "deps" include: "scope" + groups: + # ASP.NET Core と EF Core は同一トレイン（10.0.x）で同時にリリースされる。 + # PR が分かれると片方だけマージされてバージョンが割れるため 1 本にまとめる。 + # dotnet-ef も同じトレインなので同居させる。 + aspnetcore-efcore: + patterns: + - "Microsoft.AspNetCore.*" + - "Microsoft.EntityFrameworkCore.*" + - "dotnet-ef" + update-types: + - "minor" + - "patch" + # テスト基盤。src と tests で版がずれると原因の切り分けが難しくなる。 + test-tooling: + patterns: + - "Microsoft.NET.Test.Sdk" + - "Microsoft.Playwright.*" + - "xunit*" + - "coverlet.*" + update-types: + - "minor" + - "patch" + azure: + patterns: + - "Azure.*" + update-types: + - "minor" + - "patch" - package-ecosystem: "github-actions" directory: "/" @@ -23,7 +57,11 @@ updates: time: "09:30" timezone: "Asia/Tokyo" target-branch: "main" - open-pull-requests-limit: 2 + # あえてグループ化しない。同じ action を使う複数ワークフローは Dependabot が + # 元から 1 PR にまとめる（#130 は setup-dotnet を 5 ファイルまとめて更新した）。 + # ここでグループを足すと、別々の action の major 更新まで同じ PR に同居し、 + # CI が落ちたときの切り分けが難しくなる。 + open-pull-requests-limit: 5 commit-message: prefix: "deps" include: "scope"