From cbb5d6f021b7f949f41fed7ca5b26859651ce23a Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Fri, 11 Sep 2026 03:47:14 +0500 Subject: [PATCH] fix(deps): watch the nested starlarkexec module so root bumps stop breaking it internal/incusplacement/starlarkexec requires the root module, so the root's dependency graph moving is enough to leave its go.mod stale. The harness test shells `go test` and `go vet` into that directory, and Go answers "updates to go.mod needed". That is what happened to #446: a root-only bump of golang.org/x/sys turned three CI jobs red without touching a line of that module's own code. dependabot.yml listed gomod at / only, so the nested module was never watched -- the same shape as the npm manifest in #439. Claude-Session: https://claude.ai/code/session_01CKXKXND4zAgWisTtatyTHX --- .github/dependabot.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 214a70ec..926a9cc9 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -18,6 +18,23 @@ updates: - minor - patch + # internal/incusplacement/starlarkexec is a nested module that requires the + # root module, so the root's dependency graph moving is enough to leave its + # go.mod stale — `go: updates to go.mod needed`. The harness test shells + # `go test` and `go vet` into that directory, so the root-only bump in #446 + # turned three CI jobs red without touching a line of its own code. Watching + # the directory is what keeps the two in step. + - package-ecosystem: gomod + directory: /internal/incusplacement/starlarkexec + schedule: + interval: weekly + day: monday + time: "06:15" + timezone: Asia/Almaty + open-pull-requests-limit: 5 + labels: + - dependencies + - package-ecosystem: github-actions directory: / schedule: