From 30c0f0f749c47e37d596ba03573da1cf806ab4f8 Mon Sep 17 00:00:00 2001 From: Jon Galloway Date: Mon, 7 Sep 2026 16:21:58 -0700 Subject: [PATCH 1/2] Isolate specialized Dependabot updates --- .github/dependabot.yml | 24 +++++++++++++++++++ .../skills/dependency-update-review/SKILL.md | 13 +++++++++- docs/instructor/DEPENDENCY_POLICY.md | 3 +++ 3 files changed, 39 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 27bed20..bf96865 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -24,12 +24,22 @@ updates: major-updates: patterns: - "*" + exclude-patterns: + - "Microsoft.Bcl.Memory" + - "Microsoft.Extensions.DataIngestion*" + - "Microsoft.SemanticKernel.Connectors.SqliteVec" + - "SQLitePCLRaw.bundle_e_sqlite3" update-types: - "major" group-by: "dependency-name" routine-minor-patch: patterns: - "*" + exclude-patterns: + - "Microsoft.Bcl.Memory" + - "Microsoft.Extensions.DataIngestion*" + - "Microsoft.SemanticKernel.Connectors.SqliteVec" + - "SQLitePCLRaw.bundle_e_sqlite3" update-types: - "minor" - "patch" @@ -47,12 +57,22 @@ updates: major-updates: patterns: - "*" + exclude-patterns: + - "Aspire.AppHost.Sdk" + - "Microsoft.OpenApi" + - "Microsoft.SemanticKernel.Connectors.SqliteVec" + - "SQLitePCLRaw.bundle_e_sqlite3" update-types: - "major" group-by: "dependency-name" routine-minor-patch: patterns: - "*" + exclude-patterns: + - "Aspire.AppHost.Sdk" + - "Microsoft.OpenApi" + - "Microsoft.SemanticKernel.Connectors.SqliteVec" + - "SQLitePCLRaw.bundle_e_sqlite3" update-types: - "minor" - "patch" @@ -85,6 +105,10 @@ updates: routine-minor-patch: patterns: - "*" + exclude-patterns: + - "Aspire.*" + - "Microsoft.Bcl.Memory" + - "Microsoft.Extensions.DataIngestion*" update-types: - "minor" - "patch" diff --git a/.github/skills/dependency-update-review/SKILL.md b/.github/skills/dependency-update-review/SKILL.md index aeeecca..a2641f8 100644 --- a/.github/skills/dependency-update-review/SKILL.md +++ b/.github/skills/dependency-update-review/SKILL.md @@ -88,6 +88,7 @@ Then scale validation to risk: | Compatibility boundary or major | Compile dependent/generated code and run the relevant lab flow | | Coordinated set | Build and exercise every member of the set together | | Template baseline or prerelease | Re-scaffold, compare, and run the affected attendee flow | +| Fast-moving AI framework minor | Inspect release notes and run the affected lab flow when behavior or APIs changed | Do not substitute a repository-wide green build for a required template or runtime check. @@ -104,6 +105,15 @@ After repairs, rerun the failed focused check first, then all validation require by the classification. Run Markdown lint and link checks when documentation changes, and finish with `git diff --check`. +Before marking a repaired PR ready to merge: + +- Compare the final diff with the PR title and description. Remove generated + package entries and release notes for updates that were reverted, and correct + package counts. +- Record retained protected pins and their policy rationale in the PR description. +- Reply to each addressed review comment with the repair and validation evidence, + then resolve the thread. + ## Disposition rules - **merge:** The update is current, coherent, policy-aligned, documented where @@ -127,4 +137,5 @@ Return: 3. **Classification:** one row per package or coordinated set. 4. **Findings:** blockers and risks, highest severity first, with file references. 5. **Validation:** commands run and their outcomes, including skipped checks. -6. **Required action:** the smallest next step that makes the disposition actionable. \ No newline at end of file +6. **Required action:** the smallest next step that makes the disposition actionable + and reviewable. diff --git a/docs/instructor/DEPENDENCY_POLICY.md b/docs/instructor/DEPENDENCY_POLICY.md index 3f25518..1b3034c 100644 --- a/docs/instructor/DEPENDENCY_POLICY.md +++ b/docs/instructor/DEPENDENCY_POLICY.md @@ -75,6 +75,9 @@ to apply this checklist consistently to Dependabot and manual package updates. prerelease, template, or provider changes, also run the relevant attendee flow. 1. Record why a protected pin changed or was removed in the pull request and update this inventory in the same change. +1. After repairing a generated dependency pull request, reconcile its title and + description with the final diff and resolve review threads only after recording + the validation evidence. Use the `workshop-testing` skill when an update requires re-scaffolding a project, reconciling a snapshot, or exercising the workshop as an attendee. From 906b102824aafe3344424abd7f4dc81d778c03c4 Mon Sep 17 00:00:00 2001 From: Jon Galloway Date: Mon, 7 Sep 2026 17:09:49 -0700 Subject: [PATCH 2/2] Place Dependabot exclusions in owning groups --- .github/dependabot.yml | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index bf96865..6b633fa 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -57,22 +57,12 @@ updates: major-updates: patterns: - "*" - exclude-patterns: - - "Aspire.AppHost.Sdk" - - "Microsoft.OpenApi" - - "Microsoft.SemanticKernel.Connectors.SqliteVec" - - "SQLitePCLRaw.bundle_e_sqlite3" update-types: - "major" group-by: "dependency-name" routine-minor-patch: patterns: - "*" - exclude-patterns: - - "Aspire.AppHost.Sdk" - - "Microsoft.OpenApi" - - "Microsoft.SemanticKernel.Connectors.SqliteVec" - - "SQLitePCLRaw.bundle_e_sqlite3" update-types: - "minor" - "patch" @@ -99,6 +89,11 @@ updates: major-updates: patterns: - "*" + exclude-patterns: + - "Aspire.AppHost.Sdk" + - "Microsoft.OpenApi" + - "Microsoft.SemanticKernel.Connectors.SqliteVec" + - "SQLitePCLRaw.bundle_e_sqlite3" update-types: - "major" group-by: "dependency-name" @@ -106,9 +101,10 @@ updates: patterns: - "*" exclude-patterns: - - "Aspire.*" - - "Microsoft.Bcl.Memory" - - "Microsoft.Extensions.DataIngestion*" + - "Aspire.AppHost.Sdk" + - "Microsoft.OpenApi" + - "Microsoft.SemanticKernel.Connectors.SqliteVec" + - "SQLitePCLRaw.bundle_e_sqlite3" update-types: - "minor" - "patch" @@ -137,6 +133,10 @@ updates: routine-minor-patch: patterns: - "*" + exclude-patterns: + - "Aspire.*" + - "Microsoft.Bcl.Memory" + - "Microsoft.Extensions.DataIngestion*" update-types: - "minor" - "patch"