chore: group Dependabot version updates to cut PR churn - #148
Open
bk86a wants to merge 1 commit into
Open
Conversation
Each package previously got its own weekly PR (three this week alone: #144, #145, #146). Group them per ecosystem so a week's bumps arrive as one reviewable PR. pip is split production/development because the two carry different follow-up work: production bumps also need requirements.lock regenerated and a prod redeploy, dev-only bumps do not. Scoped to applies-to: version-updates, so security updates keep arriving individually and immediately rather than waiting to be batched.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the churn at the source rather than bundling it by hand each week.
Problem
dependabot.ymlhad nogroups:key, so every package got its own weekly PR and its own notification — three this week (#144, #145, #146), all superseded by the manual bundle in #147.Change
One group per ecosystem, with pip split production/development:
python-production,python-developmentdockergithub-actionsThe pip split is deliberate: the two halves carry different follow-up work. A production bump also needs
requirements.lockregenerated and a prod redeploy; a dev-only bump (ruff, pytest) is self-contained and mergeable on sight. Lumping them together would drag trivial dev bumps into the slower production review path.Every group is scoped
applies-to: version-updates, so security updates keep arriving individually and immediately instead of waiting to be batched into the weekly PR.Known limitation
This does not make Dependabot maintain
requirements.lock. Dependabot's pip ecosystem only scansrequirements*.txt(pluspyproject.toml/setup.py/Pipfile), andrequirements.lockmatches none of those patterns — so the lock regen stays a manual step on production bumps, exactly as in #147. Grouping reduces that to one lock sync per week instead of one per package.Verification
dependabot.ymlparses as valid YAML and every group key/value was checked against the Dependabot schema —applies-to∈ {version-updates, security-updates},dependency-type∈ {production, development}, no unknown keys. GitHub validates the config itself once this lands on the default branch.