From 01368db954d77271faefd22a36d7d81821e20f69 Mon Sep 17 00:00:00 2001 From: Ayla Croft Date: Sat, 19 Sep 2026 20:05:39 -0400 Subject: [PATCH 1/2] ci: quote a step name in package.yml that a bare colon had made unparseable The public-readiness change replaced an em dash in a step name with a colon, which turned the plain scalar into a mapping and made the whole file unparseable. GitHub reported it as a run named after the file path on the merge of pull request #1 (run 35477735783, zero jobs), and Dependabot's github-actions updater failed on the same file (dependency_file_not_parseable, job 1583380179). Reproduced locally with a YAML parser at line 173, column 25. No gate step parses the workflow files, so the gate was green on a workflow GitHub could not read. That is a rule that could be an enforcer and is not one yet; recorded as a follow-up for the next slice rather than added here. Signed-off-by: Ayla Croft --- .github/workflows/package.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml index f8276cf..f52c02a 100644 --- a/.github/workflows/package.yml +++ b/.github/workflows/package.yml @@ -170,7 +170,7 @@ jobs: # --no-halt is what makes the exit mean anything. Burrito launches the release as # `-s elixir start_cli`, and the Elixir CLI halts when its command list is empty, so # without --no-halt the binary exits 0 on its own and `--smoke` proves nothing. - - name: Smoke test: boots, serves, exits by itself, leaves nothing behind + - name: "Smoke test: boots, serves, exits by itself, leaves nothing behind" if: runner.os != 'Windows' shell: bash run: | From 43949d6385f71a9956b9c4b18b902035963698ca Mon Sep 17 00:00:00 2001 From: Ayla Croft Date: Sat, 19 Sep 2026 20:08:35 -0400 Subject: [PATCH 2/2] ci: Dependabot raises security updates only open-pull-requests-limit: 0 on all three ecosystems. Version bumps are not this project's to take from a bot: VERSIONS.md is the pin list and a version moves after a proposal and an approval. On its first run Dependabot opened five version-bump pull requests in two minutes, and one of them, #2, was merged by mistake in place of the pull request that fixes package.yml. Security updates still arrive as pull requests with the gate run on them. Signed-off-by: Ayla Croft --- .github/dependabot.yml | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index ab48c93..8ae018f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,29 +1,33 @@ # SPDX-FileCopyrightText: Sudo Apt Holdings LLC # SPDX-License-Identifier: Apache-2.0 # -# Dependabot opens a pull request when a dependency has a security advisory or a newer -# release. A pull request is not an upgrade: VERSIONS.md is the pin list, and a version -# lands only after it is proposed in a slice's NOTES.md and approved (CLAUDE.md section 5). -# The value here is the alert arriving as a diff with the gate run against it. +# Dependabot opens a pull request only when a dependency has a security advisory. Version +# bumps are not raised: VERSIONS.md is the pin list, and a version lands only after it is +# proposed in a slice's NOTES.md and approved (CLAUDE.md section 5). On its first run, with +# the limit above zero, it opened five version-bump pull requests inside two minutes; one of +# them was merged by mistake. An open-pull-requests-limit of 0 keeps the security updates and +# drops the rest. The value here is a security alert arriving as a diff with the gate run +# against it. version: 2 updates: - package-ecosystem: mix directory: / schedule: interval: weekly - open-pull-requests-limit: 5 + open-pull-requests-limit: 0 commit-message: prefix: "chore(deps)" - package-ecosystem: github-actions directory: / schedule: interval: weekly + open-pull-requests-limit: 0 commit-message: prefix: "chore(ci)" - package-ecosystem: cargo directory: /src-tauri schedule: interval: weekly - open-pull-requests-limit: 3 + open-pull-requests-limit: 0 commit-message: prefix: "chore(deps)"