ci: enable Dependabot version updates (ISVBE-262) - #201
Merged
Conversation
Adds .github/dependabot.yml turning on weekly grouped dependency updates. No dep-update automation existed on this repo before, so deps only surfaced as security alerts or incidents (eng-practice assessment gap #10). - grouped minor/patch into one PR per ecosystem/module to cap PR volume - major bumps left ungrouped for individual review - 7-day cooldown on version updates (security fixes never delayed) - weekly Monday 09:00 America/New_York schedule Mirrors the us-backend dependabot.yml house pattern.
Match the two-group actions split adopted in py-sdk #163: action majors open their own PR for migration-note review instead of batching in with minor/patch. Keeps them grouped so they stay within the open-PR limit. Brings this repo's ISVBE-262 config in line with the others.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL;DR
Add Dependabot version updates to ts-sdk (the repo had no dependency automation). Covers npm across the pnpm workspace and GitHub Actions, with the actions group split into minor/patch and majors so action majors open their own review PR. Part of ISVBE-262.
What changed
.github/dependabot.yml(new):npmecosystem across the pnpm workspace (/,/packages/*,/examples/*, readingpnpm-lock.yaml) andgithub-actions. npm minor/patch grouped per directory with majors left ungrouped;github-actionssplit intogithub-actions-minor-and-patchandgithub-actions-major.Not in scope: no code changes. Complements the existing
dependency-review.yml(PR-time advisory) with proactive scheduled updates.Review & risk
Config-only, no code. The only behaviour change is Dependabot's own: it opens scheduled update PRs that still run full CI before merge. 7-day cooldown on version updates (security fixes never delayed), weekly Monday 09:00 America/New_York. Reversible (revert the file).
Verified
ruby -ryaml -e "YAML.load_file('.github/dependabot.yml')"parses clean. After merge, GitHub validates the config under Insights → Dependency graph → Dependabot. Reuse: mirrors the Dependabot house pattern (us-backend #138) with the two-group GitHub Actions split adopted across the ISVBE-262 repos (py-sdk #163, go-markets #496).Context (optional depth)
The two-group actions split came out of a Cursor Bugbot flag on py-sdk #163 ("major CI updates grouped") plus a design consult. The conclusion was that a separate majors group is cleaner: action majors (e.g.
actions/checkoutv4 to v5) can change runner or input contracts, so they deserve their own PR rather than hiding in the routine bump.ts-sdk has no PR template of its own, so this body uses the us-backend template as the house fallback.
.protochange and its regeneratedgen/proto/are in the same commit (N/A, ts-sdk is TypeScript, no proto)Note
Low Risk
Config-only change; behavior is limited to Dependabot opening update PRs that still go through existing CI before merge.
Overview
Adds
.github/dependabot.ymlso the repo gets scheduled dependency update PRs (it previously had PR-timedependency-reviewonly, no proactive bumps).npm (pnpm): watches
/,/packages/*, and/examples/*weekly (Monday 09:00 ET), with a 7-day cooldown on version updates, grouped minor/patch and security PRs per directory, and ungrouped majors for separate review. GitHub Actions: same schedule with grouped minor/patch vs major bumps in distinct PRs, pluschore(deps)/chore(ci)commit prefixes and open-PR limits.Reviewed by Cursor Bugbot for commit d8d89ed. Bugbot is set up for automated code reviews on this repo. Configure here.