chore(deps): one dependabot pull request per ecosystem - #644
Merged
Conversation
The nuget group was restricted to update-types [minor, patch], which meant a major matched no group at all and got a pull request to itself -- #511 NSubstitute, #510 Npgsql+Serilog, #234, #233. So a normal week produced the three grouped PRs plus one per major, and each merge forced a rebase of the rest because the main ruleset requires branches to be up to date. Dropping the update-types filter makes the group catch everything, majors included. Three PRs a week is the floor -- Dependabot raises them per ecosystem and cannot combine nuget, github-actions and docker into one -- and this reaches it. Deliberately not changed: security updates stay ungrouped, so a CVE fix arrives as its own immediate PR instead of waiting behind a broken major in a batch of thirty. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AxWv8yHP7QAGFuFt2qS7q9
koniecdev
force-pushed
the
chore/dependabot-one-pr-per-ecosystem
branch
from
August 14, 2026 17:57
f99eb38 to
ea7191d
Compare
This was referenced Aug 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Dependabot week produced more pull requests than it looked like it should, and each merge forced a
rebase of the rest — the
mainruleset requires branches to be up to date.The cause was not the grouping, it was a gap in it. The nuget group was restricted to
update-types: ["minor", "patch"], so a major matched no group at all and earned a pullrequest of its own: #511 NSubstitute, #510 Npgsql+Serilog, #234, #233. The three grouped PRs were
the floor and the majors stacked on top.
What changes
Drop the
update-typesfilter so the group catches everything, majors included, and rename itnuget-minor-patch→nugetto match what it now does.Result: exactly three pull requests per week — nuget, github-actions, docker. That is the floor,
not a preference: Dependabot raises pull requests per ecosystem and cannot combine across them.
(Confirmed against history — the docker group already ships as one PR spanning all four
directories, e.g. #640 "across 4 directories".)
Trade-off, taken deliberately
One breaking major now blocks the whole nuget batch, and there is no way to merge the good half.
The remedy is an
ignoreentry for the offender — the Microsoft.OpenApi block right below is theworking example — after which Dependabot rebuilds the PR without it. If that turns out to sting
often, splitting majors back into their own group is a two-line reversal.
Deliberately not changed
Security updates stay ungrouped. Grouping them needs
applies-to: security-updates, and a CVEfix must never sit behind a broken major in a batch of thirty — they should keep arriving as their
own immediate pull requests.
🤖 Generated with Claude Code
https://claude.ai/code/session_01AxWv8yHP7QAGFuFt2qS7q9