Ask Dependabot monthly, and keep majors out of the routine bump - #56
Merged
Conversation
Grouping was already at its limit here - one group per ecosystem, `patterns: ["*"]` - so the volume was not coming from ungrouped updates. It was coming from multiplication: three ecosystems in abap2UI5 and two in each of nine sibling repositories, every Tuesday, is about twenty-one pull requests a week for a set of build-time tools. Nobody reads the twenty-first. Monthly is the blunt part of the fix and the effective one: the same updates, a quarter as often. The other half is that a major no longer travels with the boring ones. Each group is split by `update-types`, so a routine month produces one pull request per ecosystem containing only minor and patch bumps, and a major arrives on its own - visible as a major, and reviewable as one. actions/download-artifact 7 -> 8 was merged today inside a group; it happened to be clean, but it carried an ESM migration and a digest check that now fails a run instead of warning, and neither of those is something CI here would have caught. The scheduling comments were rewritten rather than dropped. They explained the Tuesday slot as deliberate distance from the Monday bump workflows; monthly runs land on the 1st, so that distance no longer exists and the comment would otherwise have kept claiming a property the file lost. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PLDFPfAK1MGq6qHeC6KKWH
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Part of an ecosystem-wide change — the same edit lands in all ten repositories that carry a
dependabot.yml.Grouping was already at its limit (one group per ecosystem,
patterns: ["*"]), so the volume came from multiplication: two to three ecosystems × ten repositories × every Tuesday ≈ 21 pull requests a week for build-time tools.Monthly: the same updates, a quarter as often.
Majors travel alone: each group is split by
update-types, so a routine month produces one pull request per ecosystem with only minor and patch bumps, and a major arrives separately — visible as a major, and reviewable as one.actions/download-artifact7 → 8 was merged in abap2UI5 today inside a group; it was clean, but it carried an ESM migration and a digest check that now fails a run instead of warning.Relevant here:
@openui5/*moves the render gate's runtime, and this repository ships two packages to npm whose install a stranger runs. A major folded into a group of patches is one nobody looked at.How to test
Config validated as YAML: every group carries
update-types, no leftoverday:.Checklist
Generated by Claude Code