ci: point Dependabot version updates at dev - #294
Merged
Conversation
Dependency bumps were opening against main, the default branch, while all feature work goes to dev and only reaches main at a release. That split left the two branches each stale on the other's upgrades: cutting v5.3.0 hit a MultiRoomAudio.csproj conflict where main had System.IO.Ports 10.0.11 and dev had SendSpin.SDK 9.3.0, and resolving it the obvious way would have silently downgraded one of them. Set target-branch: "dev" on all three ecosystems so bumps land where the rest of the work does and ride out with the next release. This has to go on main, since Dependabot reads its config only from the default branch. Security updates are unaffected and still target main.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sets
target-branch: "dev"on all three Dependabot ecosystems (nuget, github-actions, docker).Why
Dependency bumps were opening against
main— the default branch — while all feature work goes todevand only reachesmainat a release. That left the two branches each stale on the other's upgrades.It surfaced while cutting v5.3.0:
MultiRoomAudio.csprojconflicted becausemainhadSystem.IO.Ports 10.0.11(from #275-#278) anddevhadSendSpin.SDK 9.3.0. Resolving it in either direction would have silently downgraded a package; it needed the newer of each side taken by hand.With bumps targeting
dev, they land where the rest of the work does and ride out with the next release.Why this targets
mainrather thandevDependabot reads
.github/dependabot.ymlonly from the default branch. Ondevit would have no effect until the next release merged it tomain.Note on security updates
Dependabot security updates always target the default branch regardless of
target-branch, so those will still open againstmain. That's the desired behaviour anyway — a security fix shouldn't wait for a release cycle.No open Dependabot PRs needed retargeting; there are currently none.