chore(ci): dependabot monthly + auto-merge patch/minor (stop version-bump babysitting)#194
chore(ci): dependabot monthly + auto-merge patch/minor (stop version-bump babysitting)#194emeraldleaf wants to merge 4 commits into
Conversation
… churn landing on a human Two changes so routine dependency bumps stop needing hand-holding: 1. NuGet schedule weekly → monthly. One batch a month instead of four — PR volume (one per group) lands 12×/year, not 52×. 2. New dependabot-auto-merge workflow: patch + minor bumps get approved and set to auto-merge (GitHub merges once CI is green — same gate a human waits for). MAJOR bumps are NOT auto-merged — they get a "held for manual review" comment, because a major can carry breaking changes (this repo saw FluentValidation 11→12). Dependabot-authored PRs only. Together with the group consolidation already landed (#178 companion families, #185 the AspNet+EF coupling), a normal month should now be: a handful of grouped PRs, the patch/minor ones self-merging green, only majors (rare) asking for a person. Caveat documented in the workflow: the approve step needs "Allow GitHub Actions to approve PRs" enabled, or dependabot[bot] on the ruleset bypass list — otherwise auto-merge waits on the review requirement. Config/CI-only, no code — architecture-review gate exempt. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
WalkthroughDependabot NuGet updates now run monthly, with targeted ignores for Aspire and NSubstitute. A new workflow auto-merges patch and minor Dependabot updates while leaving major updates for manual review. ChangesDependabot automation
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant Dependabot
participant GitHubActions
participant DependabotMetadata
participant PullRequest
Dependabot->>GitHubActions: Open dependency update pull request
GitHubActions->>DependabotMetadata: Fetch semantic version metadata
DependabotMetadata-->>GitHubActions: Return update classification
GitHubActions->>PullRequest: Approve and squash-merge patch/minor update
GitHubActions->>PullRequest: Comment on major update for manual review
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/dependabot.yml (1)
62-70: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueUpdate stale comments to reflect the new monthly schedule.
The schedule interval was updated from
weeklytomonthly(lines 9-13), but these comments still refer to a "weekly" PR and bump. Update the documentation to accurately reflect the new cadence.📝 Proposed comment updates
- # deferred — Dependabot shouldn't open a weekly PR that breaks every + # deferred — Dependabot shouldn't open a monthly PR that breaks every # integration test until someone has time to read the release notes, # restructure code, and verify the saga + outbox + concurrency-retry # paths still behave. Add majors back to the ignore list as they ship # breaking changes; remove when a dedicated migration PR has landed. ignore: # WolverineFx majors are deferred pending a dedicated migration PR — a # major can break host startup or the saga/outbox/concurrency paths, and - # shouldn't land as an unreviewed weekly bump. The 5→6 migration already + # shouldn't land as an unreviewed monthly bump. The 5→6 migration already🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/dependabot.yml around lines 62 - 70, Update the stale Dependabot comments near the ignore configuration to refer to monthly pull requests and monthly bumps instead of weekly ones, while preserving the existing explanation about deferred major-version updates.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/dependabot-auto-merge.yml:
- Around line 18-19: Add a top-level concurrency configuration to the dependabot
auto-merge workflow, using a group key derived from the pull request identifier
so runs for the same PR cannot execute simultaneously. Preserve the existing
pull_request trigger and workflow behavior, and configure the group to handle
any prior run according to the repository’s standard cancellation policy.
- Around line 35-37: Add set -euo pipefail as the first command in both bash run
blocks in .github/workflows/dependabot-auto-merge.yml at lines 35-37 and 44-47,
before the existing gh commands.
---
Outside diff comments:
In @.github/dependabot.yml:
- Around line 62-70: Update the stale Dependabot comments near the ignore
configuration to refer to monthly pull requests and monthly bumps instead of
weekly ones, while preserving the existing explanation about deferred
major-version updates.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 8397cdf5-0769-449f-be0a-4a639e9f08a7
📒 Files selected for processing (2)
.github/dependabot.yml.github/workflows/dependabot-auto-merge.yml
| on: pull_request | ||
|
|
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
Add a missing concurrency: group.
Adding a concurrency group prevents multiple instances of this workflow from running simultaneously on the same PR, saving CI resources and preventing race conditions during auto-merge.
As per path instructions, DO flag missing concurrency: groups.
🚦 Proposed fix
on: pull_request
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.ref }}
+ cancel-in-progress: true📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| on: pull_request | |
| on: pull_request | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 18-18: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/dependabot-auto-merge.yml around lines 18 - 19, Add a
top-level concurrency configuration to the dependabot auto-merge workflow, using
a group key derived from the pull request identifier so runs for the same PR
cannot execute simultaneously. Preserve the existing pull_request trigger and
workflow behavior, and configure the group to handle any prior run according to
the repository’s standard cancellation policy.
Source: Path instructions
| run: | | ||
| gh pr review --approve "$PR_URL" | ||
| gh pr merge --auto --squash "$PR_URL" |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
Include set -euo pipefail in bash run blocks.
Applying strict bash execution flags ensures that any unhandled errors or unbound variables cause the script to fail immediately, preventing unintended behavior. As per path instructions, DO flag missing set -euo pipefail in bash run blocks.
.github/workflows/dependabot-auto-merge.yml#L35-L37: Addset -euo pipefailat the start of therunblock..github/workflows/dependabot-auto-merge.yml#L44-L47: Addset -euo pipefailat the start of therunblock.
🛠️ Proposed fixes
For lines 35-37:
run: |
+ set -euo pipefail
gh pr review --approve "$PR_URL"For lines 44-47:
run: |
+ set -euo pipefail
gh pr comment "$PR_URL" --body "🔎 **Major version bump — held for manual review.** \📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| run: | | |
| gh pr review --approve "$PR_URL" | |
| gh pr merge --auto --squash "$PR_URL" | |
| run: | | |
| set -euo pipefail | |
| gh pr review --approve "$PR_URL" | |
| gh pr merge --auto --squash "$PR_URL" |
📍 Affects 1 file
.github/workflows/dependabot-auto-merge.yml#L35-L37(this comment).github/workflows/dependabot-auto-merge.yml#L44-L47
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/dependabot-auto-merge.yml around lines 35 - 37, Add set
-euo pipefail as the first command in both bash run blocks in
.github/workflows/dependabot-auto-merge.yml at lines 35-37 and 44-47, before the
existing gh commands.
Source: Path instructions
…ePack bump, not a lone PR Folds into the dependabot-tuning PR. #189 (Aspire 13.4.6) had to be closed: dependabot can bump Aspire.Hosting.* but not the Aspire.AppHost.Sdk pin in the .csproj, and the bump drags MessagePack past the security pin — a 3-file coordinated change dependabot can't do. So Aspire is a deliberate manual bump; stop the failing weekly auto-PR. Majors still surface (migration signal). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…), not a weekly bump Folds into the dependabot-tuning PR. #192 closed: NSubstitute 6.0 tightened Arg.Is<T> nullability, tripping CS8602 in OrderSagaTests. 5.x is stable; take 6.x deliberately if warranted. Same major-defer treatment as WolverineFx. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/dependabot.yml (1)
9-13: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winIncrease
open-pull-requests-limitto prevent major updates from blocking auto-merges.With the schedule changed to
monthlyand 9 dependency groups defined, the existingopen-pull-requests-limit: 5(on line 14) creates a bottleneck.
If Dependabot opens 5 PRs for major updates (which wait for manual review), the limit is reached. This blocks Dependabot from opening any patch/minor PRs for the remaining groups until the major updates are cleared, which defeats the goal of clearing routine updates without human intervention.
Consider increasing the limit to accommodate all groups and potential standalone updates (e.g., 15).⚙️ Proposed fix
schedule: # Monthly, not weekly — batches a month of bumps into one wave instead of four, # so the PR volume (one per group) lands 12×/year not 52×. Patch/minor auto-merge # (see .github/workflows/dependabot-auto-merge.yml) clears the routine ones without # a human; only majors wait for a person. interval: monthly - open-pull-requests-limit: 5 + open-pull-requests-limit: 15🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/dependabot.yml around lines 9 - 13, Increase the open-pull-requests-limit setting in the Dependabot configuration from 5 to at least 15, allowing all dependency groups and standalone updates to be opened while major-update PRs await manual review.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/dependabot.yml:
- Around line 73-75: The comments in .github/dependabot.yml at lines 73-75 and
86-88 still describe a weekly cadence; update “weekly auto-PR” to “monthly
auto-PR” or “automated PR” at lines 73-75, and replace “weekly bump” with
“monthly bump” at lines 86-88. Also clean up the stale weekly references at
lines 62 and 80 if they describe the same schedule.
---
Outside diff comments:
In @.github/dependabot.yml:
- Around line 9-13: Increase the open-pull-requests-limit setting in the
Dependabot configuration from 5 to at least 15, allowing all dependency groups
and standalone updates to be opened while major-update PRs await manual review.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: fbc4bd4e-0286-46dd-bcee-50a1b2fd582a
📒 Files selected for processing (1)
.github/dependabot.yml
1 participant
The "why do the PRs keep growing" fix. Dependabot opens one PR per group on a schedule; with weekly + 8 groups that's ~8 PRs/week, and every package PR conflicts the others on
Directory.Packages.props. This makes the routine ones handle themselves.Two changes
dependabot-auto-merge.yml) — patch + minor bumps get approved and set to--automerge (GitHub merges them the moment CI is green — the same gate you'd wait for). Majors are NOT auto-merged — they get a "held for manual review" comment, because a major can break things (FluentValidation 11→12 was a real one here). Dependabot PRs only; can't touch human PRs.Combined with what already landed
Net: a normal month becomes a few grouped PRs, the patch/minor ones merging themselves green, only the occasional major asking for you.
One setup caveat (documented in the workflow)
The approve step runs as the github-actions bot. For it to satisfy a review-requiring ruleset, Settings → Actions → General → "Allow GitHub Actions to create and approve pull requests" must be on — or add
dependabot[bot]to the ruleset's bypass list. If neither, auto-merge just waits on the review (no harm, but it won't self-merge).Config/CI-only — architecture-review gate exempt.
🤖 Generated with Claude Code
Summary by CodeRabbit