Skip to content

CI: exclude host-provided packages (Cove SDK, EF Core) from Dependabot#85

Merged
alextomas955 merged 1 commit into
mainfrom
dependabot-ignore-host-packages
Jul 17, 2026
Merged

CI: exclude host-provided packages (Cove SDK, EF Core) from Dependabot#85
alextomas955 merged 1 commit into
mainfrom
dependabot-ignore-host-packages

Conversation

@alextomas955

@alextomas955 alextomas955 commented Jul 17, 2026

Copy link
Copy Markdown
Owner

Stops Dependabot from proposing bumps to packages whose versions are dictated by the Cove host, not by us.

Why

  • Cove.Sdk / Cove.Plugins / Cove.Core are the host SDK. Their version is pinned to the $(CoveSdkVersion) property and coupled to each extension's minCoveVersion, so they move only in lockstep with the deployed Cove host — a Dependabot bump breaks the ABI / minCoveVersion contract.
  • Microsoft.EntityFrameworkCore* is host-provided (referenced Private=false); its version must equal the host's runtime, or you get an AssemblyLoadContext type-identity mismatch.

Dependabot does not respect the $(CoveSdkVersion) property indirection the config previously relied on — it rewrote the property and injected a VersionOverride, opening exactly the wrong PRs (#62, #82, #83).

Change

  • Add an ignore list to the nuget block: Cove.Sdk, Cove.Plugins, Cove.Core, Microsoft.EntityFrameworkCore*.
  • Drop Microsoft.EntityFrameworkCore* from the test-analysis group (no longer Dependabot-managed).
  • Correct the stale comment that claimed the property indirection was sufficient.

These packages stay hand-bumped in lockstep with the host, as intended.

@alextomas955 @claude
CI: exclude host-provided packages (Cove SDK, EF Core) from Dependabot
f238d19 
Cove.Sdk/Cove.Plugins/Cove.Core are the host SDK — their version is pinned to
$(CoveSdkVersion) and coupled to minCoveVersion, so they move only in lockstep
with the deployed Cove host, never via Dependabot. EF Core is referenced
Private=false and must equal the host's runtime version (a mismatch is an
AssemblyLoadContext type-identity break).

Dependabot ignored the property indirection and bumped these anyway (#62/#82/#83).
Add an explicit `ignore` for the Cove.* SDK packages + Microsoft.EntityFrameworkCore*,
and drop EF Core from the test-analysis group (it is no longer Dependabot-managed).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@sonarqubecloud

sonarqubecloud Bot commented Jul 17, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@greptile-apps

greptile-apps Bot commented Jul 17, 2026

Copy link
Copy Markdown

Greptile Summary

Prevents Dependabot from opening upgrade PRs for NuGet packages whose versions are dictated by the Cove host runtime, not by this repo — fixing a real gap where the previous reliance on MSBuild property indirection failed and produced incorrect PRs (#62, #82, #83).

  • Adds an ignore block covering Cove.Sdk, Cove.Plugins, Cove.Core, and Microsoft.EntityFrameworkCore*, replacing the now-corrected comment that claimed property indirection was sufficient protection.
  • Removes Microsoft.EntityFrameworkCore* from the test-analysis group patterns, since ignored packages cannot be grouped by Dependabot anyway.

Confidence Score: 5/5

Safe to merge — the change is additive configuration that prevents unwanted automation, with no code paths or runtime behaviour affected.

The change is a single-file Dependabot config edit that adds four ignore entries and removes a now-irrelevant group pattern. The ignore syntax (including the Microsoft.EntityFrameworkCore* wildcard) is valid Dependabot v2, the rationale matches the documented host-ABI constraint, and removing the EF Core entry from the test-analysis group is consistent with it being fully excluded.

No files require special attention.

Important Files Changed

Filename Overview
.github/dependabot.yml Adds an ignore list for host-ABI-critical NuGet packages (Cove SDK family + EF Core wildcard) and removes the EF Core pattern from the test-analysis group, which is now redundant since the packages are fully excluded.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Dependabot detects NuGet update] --> B{Is package in ignore list?}
    B -- "Cove.Sdk / Cove.Plugins / Cove.Core\nor Microsoft.EntityFrameworkCore*" --> C[Skip — no PR opened]
    B -- Other packages --> D{Is package in a group?}
    D -- "xunit* / coverlet.* /\nMicrosoft.NET.Test.Sdk /\nXunit.SkippableFact" --> E[Grouped PR: test-analysis]
    D -- Other --> F[Individual update PR]
    C --> G[Hand-bumped in lockstep\nwith Cove host release]
Loading 
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[Dependabot detects NuGet update] --> B{Is package in ignore list?}
    B -- "Cove.Sdk / Cove.Plugins / Cove.Core\nor Microsoft.EntityFrameworkCore*" --> C[Skip — no PR opened]
    B -- Other packages --> D{Is package in a group?}
    D -- "xunit* / coverlet.* /\nMicrosoft.NET.Test.Sdk /\nXunit.SkippableFact" --> E[Grouped PR: test-analysis]
    D -- Other --> F[Individual update PR]
    C --> G[Hand-bumped in lockstep\nwith Cove host release]
Loading

Reviews (1): Last reviewed commit: "CI: exclude host-provided packages (Cove..." | Re-trigger Greptile

@alextomas955
alextomas955 merged commit df2f248 into main Jul 17, 2026
14 checks passed
@alextomas955
alextomas955 deleted the dependabot-ignore-host-packages branch July 17, 2026 22:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@alextomas955