From 5526b2ff4766cc9e9035e51779ec289103367558 Mon Sep 17 00:00:00 2001 From: Benjamin Simon Date: Tue, 10 Nov 2026 19:05:55 +0100 Subject: [PATCH 1/3] ci(dependabot): group updates and skip auto-merge for majors Group minor/patch dev-dependency updates in the root package, all minor/patch updates in /cdk, and all GitHub Actions updates, so a typical week produces ~2 PRs instead of 4-6. The runtime dependency (uuid) stays ungrouped because it reaches consumers via the git-tag pin, and major bumps stay as individual PRs. The auto-merge workflow now skips semver-major updates so they get a manual review. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 15 +++++++++++++++ .github/workflows/dependabot-automerge.yml | 1 + 2 files changed, 16 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 19f45c7..d3ddadd 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,16 +1,31 @@ version: 2 updates: + # Library deps. `uuid` is the only runtime dependency and ships to consumers + # via the git-tag pin, so it is deliberately left out of the group and keeps + # its own PR. Majors also stay ungrouped so they can be reviewed individually. - package-ecosystem: "npm" directory: "/" schedule: interval: "weekly" + groups: + dev-dependencies: + dependency-type: "development" + update-types: ["minor", "patch"] - package-ecosystem: "github-actions" directory: "/" schedule: interval: "weekly" + groups: + github-actions: + patterns: ["*"] + # CDK test infrastructure: nothing here reaches consumers, so batch it all. - package-ecosystem: "npm" directory: "/cdk" schedule: interval: "weekly" + groups: + cdk: + patterns: ["*"] + update-types: ["minor", "patch"] diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index c569ba9..b7ce057 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -16,6 +16,7 @@ jobs: with: github-token: "${{ secrets.GITHUB_TOKEN }}" - name: Enable auto-merge for Dependabot PRs + if: steps.metadata.outputs.update-type != 'version-update:semver-major' run: gh pr merge --auto --squash "$PR_URL" env: PR_URL: ${{github.event.pull_request.html_url}} From 81077c913f9c89b20da3b3cfcc889bfadc9f554c Mon Sep 17 00:00:00 2001 From: Benjamin Simon Date: Tue, 10 Nov 2026 19:30:21 +0100 Subject: [PATCH 2/3] ci(dependabot): keep GitHub Actions majors out of the group Without this, one action major blocks auto-merge for the whole group PR. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d3ddadd..077c9fb 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -19,6 +19,7 @@ updates: groups: github-actions: patterns: ["*"] + update-types: ["minor", "patch"] # CDK test infrastructure: nothing here reaches consumers, so batch it all. - package-ecosystem: "npm" From 0653ef1092c000d141e7b008496b8d5e3f3855f9 Mon Sep 17 00:00:00 2001 From: Benjamin Simon Date: Tue, 10 Nov 2026 19:33:28 +0100 Subject: [PATCH 3/3] ci: add CODEOWNERS and assign Dependabot PRs Request review from @bentsku on every PR and assign Dependabot PRs. The main ruleset requires no approvals, so auto-merge is unaffected. Co-Authored-By: Claude Opus 5.5 --- .github/CODEOWNERS | 1 + .github/dependabot.yml | 6 ++++++ 2 files changed, 7 insertions(+) create mode 100644 .github/CODEOWNERS diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..66cdce5 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1 @@ +* @bentsku diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 077c9fb..906a6e4 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,6 +7,8 @@ updates: directory: "/" schedule: interval: "weekly" + assignees: + - "bentsku" groups: dev-dependencies: dependency-type: "development" @@ -16,6 +18,8 @@ updates: directory: "/" schedule: interval: "weekly" + assignees: + - "bentsku" groups: github-actions: patterns: ["*"] @@ -26,6 +30,8 @@ updates: directory: "/cdk" schedule: interval: "weekly" + assignees: + - "bentsku" groups: cdk: patterns: ["*"]