Repository navigation
ci(dependabot): group updates and skip auto-merge for majors - #348
Merged
Merged
Conversation
Group minor/patch dev-dependency updates in the root package, all minor/patch updates in /cdk, and all GitHub Actions updates, so a typical week produces ~2 PRs instead of 4-6. The runtime dependency (uuid) stays ungrouped because it reaches consumers via the git-tag pin, and major bumps stay as individual PRs. The auto-merge workflow now skips semver-major updates so they get a manual review. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Without this, one action major blocks auto-merge for the whole group PR. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Request review from @bentsku on every PR and assign Dependabot PRs. The main ruleset requires no approvals, so auto-merge is unaffected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Dependabot opens one PR per package, and the auto-merge workflow squash-merges each one, so most commits on
mainare dependency bumps (24 of 32 over a recent 90-day window). The same packages recur every week, andjestarrives twice because it's in bothpackage.jsonfiles.Changes
uuid, the only runtime dependency, stays ungrouped because it reaches consumers through the git-tag pin./cdknpm: all minor/patch updates are grouped into one PR. Nothing here reaches consumers.version-update:semver-major, so major bumps wait for manual review..github/CODEOWNERS(* @bentsku), so review is requested on every PR, and setsassignees: [bentsku]on all Dependabot entries. Themainruleset requires 0 approvals and no code-owner review, so auto-merge is unaffected.A typical week should drop from 4–6 Dependabot PRs to about 2.
Testing
Both files parse as valid YAML. Dependabot only reads its config from the default branch, so the grouping can't be checked until this merges. The first scheduled run after merging will show it.
🤖 Generated with Claude Code