Skip to content

Commit 29b46b5

Browse files
matthieusiebengithub-actions[bot]
matthieusieben
and
github-actions[bot]
authored
configure debendabot (#5308)
* configure debendabot * chore: group dependabot updates and raise npm PR limit Weekly npm updates across ~30 workspace packages plus 4 Docker images produce a steady stream of individual PRs. Batch them instead: - npm: group minor/patch dev and prod dependency bumps into one PR each, leaving majors ungrouped so they stay individually reviewable. Raise open-pull-requests-limit to 10 to leave room for those majors. - docker: all four services pin the same node:*-alpine base image, so group them into a single PR rather than four near-identical ones. * add github-actions * add dependabot-changeset workflow * tidy * roasted --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 825dd9b commit 29b46b5

3 files changed

Lines changed: 165 additions & 2 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: 'npm'
4+
directory: '/'
5+
schedule:
6+
interval: 'weekly'
7+
open-pull-requests-limit: 10
8+
groups:
9+
# Dev tooling churns the most and never ships in a published artifact,
10+
# so a single PR per week keeps the review surface small.
11+
dev-dependencies:
12+
dependency-type: 'development'
13+
update-types:
14+
- 'minor'
15+
- 'patch'
16+
# Non-breaking runtime bumps, batched into one PR. Majors are excluded
17+
# here so they land individually and stay attributable.
18+
prod-dependencies:
19+
dependency-type: 'production'
20+
update-types:
21+
- 'minor'
22+
- 'patch'
23+
- package-ecosystem: 'github-actions'
24+
directory: '/'
25+
schedule:
26+
interval: 'weekly'
27+
groups:
28+
# CI-only, and a bad bump fails loudly on the next run, so batch every
29+
# action bump (majors included) into one PR.
30+
actions:
31+
patterns:
32+
- '*'
33+
- package-ecosystem: 'docker'
34+
directories:
35+
- '/services/bsky'
36+
- '/services/bsync'
37+
- '/services/ozone'
38+
- '/services/pds'
39+
schedule:
40+
interval: 'weekly'
41+
groups:
42+
# All four services pin the same node:*-alpine base image; group them so
43+
# a base image bump is one PR instead of four near-identical ones.
44+
base-images:
45+
patterns:
46+
- '*'

‎.github/workflows/dependabot-changeset.yml‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
# Keeps Dependabot PRs compatible with the Changeset check in repo.yaml by
2+
# generating (and force-refreshing) a changeset from the PR's diff.
3+
#
4+
# Side effect: once this workflow pushes, Dependabot considers the branch
5+
# externally modified and stops auto-rebasing the PR. That's fine — grouped
6+
# updates arrive as fresh PRs weekly, and `@dependabot recreate` still works
7+
# (the recreated branch re-triggers this workflow).
8+
name: Dependabot Changeset
9+
10+
on:
11+
pull_request:
12+
13+
permissions:
14+
contents: write # push the changeset commit
15+
actions: write # dispatch repo.yaml on the new head
16+
17+
concurrency:
18+
group: '${{ github.workflow }}-${{ github.head_ref }}'
19+
cancel-in-progress: true
20+
21+
jobs:
22+
changeset:
23+
name: Generate changeset
24+
runs-on: ubuntu-latest
25+
# Only same-repo PRs authored by dependabot. PR author (not actor) so a
26+
# human reopening/rebasing the PR still gets a changeset regenerated.
27+
if: >
28+
github.event.pull_request.user.login == 'dependabot[bot]' &&
29+
github.event.pull_request.head.repo.full_name == github.repository
30+
steps:
31+
- uses: actions/checkout@v4
32+
with:
33+
# The event's head commit, not the merge ref (so the push below is a
34+
# fast-forward of the PR branch) and not the branch name (so a ref
35+
# that moved after the event was validated makes the push fail
36+
# loudly instead of silently building on an unvetted commit).
37+
ref: ${{ github.event.pull_request.head.sha }}
38+
fetch-depth: 0 # needed for git diff against base branch
39+
40+
- name: Generate and push changeset
41+
id: generate
42+
env: # env indirection: never interpolate PR-controlled strings into the script
43+
PR_NUMBER: ${{ github.event.pull_request.number }}
44+
PR_TITLE: ${{ github.event.pull_request.title }}
45+
BASE_REF: ${{ github.event.pull_request.base.ref }}
46+
HEAD_REF: ${{ github.event.pull_request.head.ref }}
47+
run: |
48+
# Dependabot only touches package.json files and the root lockfile,
49+
# and the lockfile lives outside every workspace package, so the
50+
# changed non-private package.json files are exactly the packages
51+
# `changeset status` would report as changed. Private / versionless
52+
# packages (services/*, root) cannot be versioned by changesets.
53+
pkgs=$(git diff --name-only "origin/$BASE_REF"...HEAD -- '*/package.json' |
54+
while read -r f; do
55+
[ -f "$f" ] && jq -r 'if .private == true or .version == null then empty else .name end' "$f"
56+
done | sort -u)
57+
58+
# Always (re)compute our changeset from the current diff: grouped PRs
59+
# are re-created with a different set of bumped packages every week,
60+
# so a changeset from an earlier run may list stale packages — or
61+
# need to disappear entirely if no versionable package changed.
62+
changeset=".changeset/dependabot-${PR_NUMBER}.md"
63+
if [ -z "$pkgs" ]; then
64+
rm -f "$changeset"
65+
else
66+
{
67+
echo '---'
68+
while read -r name; do echo "'$name': patch"; done <<<"$pkgs"
69+
echo '---'
70+
echo
71+
printf '%s\n' "$PR_TITLE"
72+
} >"$changeset"
73+
fi
74+
75+
git add .changeset
76+
if git diff --cached --quiet; then
77+
echo 'Changeset up to date; nothing to push.'
78+
exit 0
79+
fi
80+
# Commit as the github-actions[bot] app account, matching the
81+
# identity changesets/action uses for "Version packages" commits.
82+
git config user.name 'github-actions[bot]'
83+
git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
84+
git commit -m 'Sync changeset with Dependabot update'
85+
git push origin "HEAD:$HEAD_REF"
86+
echo 'pushed=true' >>"$GITHUB_OUTPUT"
87+
88+
# A push made with GITHUB_TOKEN does not re-trigger pull_request
89+
# workflows, so the new head commit would show no checks. Explicit
90+
# workflow_dispatch is exempt from that rule and attaches its check
91+
# runs to the new head commit.
92+
- name: Re-run CI on the new head
93+
if: steps.generate.outputs.pushed == 'true'
94+
env:
95+
GH_TOKEN: ${{ github.token }}
96+
HEAD_REF: ${{ github.event.pull_request.head.ref }}
97+
run: gh workflow run repo.yaml --repo "$GITHUB_REPOSITORY" --ref "$HEAD_REF"

‎.github/workflows/repo.yaml‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,27 @@ name: Repository CI
22

33
on:
44
pull_request:
5+
# Dispatched by dependabot-changeset.yml after it pushes a changeset commit:
6+
# pushes made with GITHUB_TOKEN don't trigger pull_request runs, so checks
7+
# for the new head commit have to be created explicitly. Required status
8+
# checks match on check-run (job) names, so those dispatched runs only
9+
# satisfy the merge gate as long as job names don't depend on the event
10+
# type.
11+
workflow_dispatch:
12+
13+
# Read-only: every job here only checks out and builds. Declared explicitly
14+
# because workflow_dispatch runs would otherwise inherit the repository-default
15+
# token scopes, which can include write.
16+
permissions:
17+
contents: read
518

619
concurrency:
7-
group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
20+
# head_ref is only set on pull_request runs; ref_name covers the
21+
# workflow_dispatch re-runs. Both resolve to the bare branch name (unlike
22+
# ref, which is the fully qualified refs/heads/... on dispatch), so a
23+
# dispatched re-run cancels the same branch's in-flight PR run and
24+
# vice-versa instead of running alongside it.
25+
group: '${{ github.workflow }}-${{ github.head_ref || github.ref_name }}'
826
cancel-in-progress: true
927

1028
jobs:
@@ -83,7 +101,9 @@ jobs:
83101
- run: pnpm install --frozen-lockfile
84102
env:
85103
PUPPETEER_SKIP_DOWNLOAD: true
86-
- run: pnpm changeset status --since=origin/${{ github.base_ref }}
104+
# github.base_ref is only set on pull_request events; workflow_dispatch
105+
# runs compare against the default branch.
106+
- run: pnpm changeset status --since=origin/${{ github.base_ref || 'main' }}
87107

88108
test:
89109
name: Test

0 commit comments

Comments
 (0)