Skip to content

chore(deps): update dependabot/fetch-metadata action to v2.5.0#879

Merged
rjmurillo merged 1 commit intomainfrom
renovate/dependabot-fetch-metadata-2.x
Feb 21, 2026
Merged

chore(deps): update dependabot/fetch-metadata action to v2.5.0#879
rjmurillo merged 1 commit intomainfrom
renovate/dependabot-fetch-metadata-2.x

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Jan 5, 2026 •
edited
Loading

This PR contains the following updates:

Package Type Update Change
dependabot/fetch-metadata action minor v2.4.0 → v2.5.0

Release Notes

dependabot/fetch-metadata (dependabot/fetch-metadata)

v2.5.0

Compare Source

What's Changed

Full Changelog: dependabot/fetch-metadata@v2...v2.5.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from rjmurillo as a code owner January 5, 2026 21:58
@renovate renovate bot enabled auto-merge (squash) January 5, 2026 21:58
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Jan 5, 2026

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Comment @coderabbitai help to get the list of available commands and usage tips.

@diffray diffray bot added the diffray-review-started diffray review status: started label Jan 5, 2026
@deepsource-io
Copy link
Copy Markdown

deepsource-io bot commented Jan 5, 2026 •
edited
Loading

DeepSource Code Review

DeepSource reviewed changes in the commit range 894313b...129f0c2 on this pull request. Below is the summary for the review, and you can see the individual issues we found as review comments.

For detailed review results, please see the PR on DeepSource ↗

PR Report Card

Security × 0 issues Overall PR Quality   

Reliability × 0 issues
Complexity × 0 issues
Hygiene × 0 issues

Code Review Summary

Analyzer Status Summary Details
C# No new issues detected. Review ↗
How are these analyzer statuses calculated?

Administrators can configure which issue categories are reported and cause analysis to be marked as failed when detected. This helps prevent bad and insecure code from being introduced in the codebase. If you're an administrator, you can modify this in the repository's settings.

@codacy-production
Copy link
Copy Markdown

codacy-production bot commented Jan 5, 2026 •
edited
Loading

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation Diff coverage
✅ +0.00% (target: -1.00%) ✅ ∅ (target: 95.00%)
Coverage variation details
Coverable lines Covered lines Coverage
Common ancestor commit (894313b) 2056 1831 89.06%
Head commit (129f0c2) 2056 (+0) 1831 (+0) 89.06% (+0.00%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details
Coverable lines Covered lines Diff coverage
Pull request (#879) 0 0 ∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings    Change summary preferences

@traycerai traycerai bot mentioned this pull request Jan 5, 2026
Open
2 tasks
@diffray diffray bot added diffray-review-failed diffray review status: failed and removed diffray-review-started diffray review status: started labels Jan 5, 2026
@renovate renovate bot force-pushed the renovate/dependabot-fetch-metadata-2.x branch 10 times, most recently from 5d377f1 to 65ec94c Compare February 19, 2026 02:51
@renovate renovate bot force-pushed the renovate/dependabot-fetch-metadata-2.x branch from 65ec94c to 129f0c2 Compare February 20, 2026 21:14
@rjmurillo rjmurillo mentioned this pull request Feb 21, 2026
Closed
rjmurillo
rjmurillo approved these changes Feb 21, 2026
View reviewed changes
Copy link
Copy Markdown
Owner

@rjmurillo rjmurillo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

dependabot/fetch-metadata 2.4.0 to 2.5.0: minor update, GitHub Action only. All CI checks pass. Safe to merge.

@rjmurillo rjmurillo merged commit 6a7f839 into main Feb 21, 2026
32 of 35 checks passed
@rjmurillo rjmurillo deleted the renovate/dependabot-fetch-metadata-2.x branch February 21, 2026 01:28
@rjmurillo rjmurillo mentioned this pull request Feb 21, 2026
Merged
5 tasks
rjmurillo added a commit that referenced this pull request Feb 21, 2026
@rjmurillo @claude @cursoragent
chore: consolidate dependency management workflows and documentation (#…
381b0af 
…915)

## Summary

- Disable dependabot for NuGet, consolidate to renovate-only
- Consolidate 4 overlapping auto-approve/merge workflows into 1
- Update renovate.json with proper package grouping and exclusion rules
- Add `docs/dependency-management.md` documenting package categories and
upgrade policies

## Problem

Both dependabot and renovate created duplicate PRs for every NuGet
update. Dependabot NuGet PRs used "Bump X from A to B" titles that
failed the required "Validate PR title" check (conventional commits
required), so they could never auto-merge. Four overlapping
auto-approve/merge workflows competed with each other, one of which had
a broken step referencing a nonexistent step output
(`steps.cpr.outputs`).

## Changes

### Dependabot config (`.github/dependabot.yml`)
Removed the `nuget` ecosystem. Retained `github-actions` ecosystem
(dependabot's fetch-metadata action provides update-type classification
for major version gating).

### Workflow consolidation
Deleted 3 workflows, kept and expanded 1:
- **Deleted:** `auto-approve-and-merge-renovate.yml`,
`dependabot-auto-approve.yml`, `dependabot-auto-merge.yml`
- **Kept:** `dependabot-approve-and-auto-merge.yml` with separate jobs
for dependabot and renovate

### Renovate config (`renovate.json`)
- Added `ignoreDeps` for `Microsoft.CodeAnalysis.*` core packages (same
policy as former dependabot ignore list)
- Grouped `BenchmarkDotNet` + `Perfolizer` as `benchmark-tooling` with
`automerge: false` (coordinated updates required due to transitive
dependency constraints)
- Disabled `System.CommandLine` and `System.CommandLine.Rendering`
updates until PerfDiff rewrite (#914)

### Documentation
New `docs/dependency-management.md` covers:
- Package categories (shipped, build-time, test, benchmark, tools,
infrastructure)
- Upgrade policies per category
- The VersionOverride pattern for non-shipped projects
- Lessons from the CS8032/SCI incident (#850)

## Bot PR cleanup performed

| Action | PRs |
|--------|-----|
| Closed (dependabot duplicates) | #903, #902, #890, #880, #909 |
| Closed (superseded) | #877 (Meziantou 2.0.302, superseded by 3.x) |
| Closed (build failures) | #834 (BenchmarkDotNet), #832 (Perfolizer) |
| Closed (PerfDiff breakage) | #821 (dotnet monorepo) |
| Merged | #878, #882, #881, #879, #883, #884 |

## Validation

- `dotnet build /p:PedanticMode=true`: 0 warnings, 0 errors
- `dotnet format`: no changes needed
- Tests cannot run locally (machine has .NET 10 only, test TFM is
net8.0); CI will validate

## Test plan

- [ ] CI build passes
- [ ] All tests pass
- [ ] No new bot PRs from dependabot for NuGet packages
- [ ] Renovate correctly picks up future dependency updates
- [ ] Auto-approve/merge workflow fires for new renovate PRs

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Consolidated dependency-update process: moved NuGet management to
Renovate, removed several automated auto-approve/auto-merge workflows
for bot PRs, and adjusted automerge/approval behavior and rules.
* Renovate configuration updated with new groups, ignore lists, and
automerge adjustments.

* **Documentation**
* Added a dependency management guide detailing categories, upgrade
policies, configuration patterns, and workflow recommendations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rjmurillo rjmurillo rjmurillo approved these changes

Assignees

No one assigned

Labels

diffray-review-failed diffray review status: failed

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rjmurillo