Repository navigation
deps: group actions majors and docker image bumps - #102
Merged
Merged
Conversation
Today's backlog clear-out hit the same friction twice: bumps that all edit one file arriving as one PR each, so every merge re-conflicted the rest. - github-actions majors were ungrouped, so setup-node, upload-artifact, cache and login-action came separately and all touched ci.yml/release.yml. #94 and #97 were rebased repeatedly and ended up folded in by hand. - docker base-image digests all edit the Dockerfile: #67/#68, then #87/#88, each pair needing a sequential update-branch + merge. Grouping both collapses those into one PR per ecosystem per week, matching what the nuget entry already does. Also makes actions-minor-patch's implicit patterns: ["*"] explicit, so the two groups read symmetrically.
thomas-lg
added a commit
that referenced
this pull request
Sep 13, 2026
Today's backlog clear-out hit the same friction twice: bumps that all edit one file arriving as one PR each, so every merge re-conflicted the rest. - github-actions majors were ungrouped, so setup-node, upload-artifact, cache and login-action came separately and all touched ci.yml/release.yml. #94 and #97 were rebased repeatedly and ended up folded in by hand. - docker base-image digests all edit the Dockerfile: #67/#68, then #87/#88, each pair needing a sequential update-branch + merge. Grouping both collapses those into one PR per ecosystem per week, matching what the nuget entry already does. Also makes actions-minor-patch's implicit patterns: ["*"] explicit, so the two groups read symmetrically.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Comes straight out of today's backlog clear-out, which hit the same friction twice: bumps that all edit one file, arriving as one PR each. Because
mainrequires up-to-date branches, every merge re-conflicted the rest.setup-node,upload-artifact,cacheandlogin-actioneach got their own PR, all touchingci.yml/release.yml. deps: bump actions/cache from 4.3.0 to 6.1.0 #95 and deps: bump actions/upload-artifact from 4.6.2 to 7.0.1 #96 merged fine, but deps: bump docker/login-action from 3.7.0 to 4.6.0 #94 and deps: bump actions/setup-node from 6.4.0 to 7.0.0 #97 re-conflicted after every merge and were eventually folded into deps: setup-node 7, login-action 4, and dependabot/script hygiene #98 by hand.Dockerfile. deps: bump dotnet/sdk fromea8bde3toed034a8#67/deps: bump dotnet/aspnet from7644f99to1fa23fc#68 and then deps: bump dotnet/sdk fromed034a8toe1ffd2a#87/deps: bump dotnet/aspnet from1fa23fctoa4556ed#88 each needed a sequentialupdate-branch+ merge.Grouping both collapses them into one PR per ecosystem per week, matching what the
nugetentry already does.actions-minor-patch's implicitpatterns: ["*"]is made explicit so the two groups read symmetrically.The current shape after this:
dotnet-minor-patch,dotnet-majornpm-minor-patch/docker-imagesactions-minor-patch,actions-majorNote on why this lands now
Merging a change to
.github/dependabot.ymlmakes Dependabot re-evaluate the config, which is also the only CLI-accessible way to exercise the grouping and ignore rules added earlier today (#86, #92, #98) — there's no API behind the Check for updates button. Those rules parse but have never actually run, so this doubles as the trigger. Expected next run: at most one grouped PR per ecosystem, no ImageSharp or Microsoft.OpenApi major, no typescript 7.