Repository navigation
chore(deps): keep Dependabot off the cloud-commitments-go pseudo-version pins #86
Description
Summary
#84 added .github/dependabot.yml with a gomod entry. The four github.com/LeanerCloud/cloud-commitments-go/* requirements are pseudo-versions, because that repo has no tags. They are bumped by hand, as in #61. The merge driver's review of #84 suggested an explicit ignore entry, so Dependabot never proposes a bump or a downgrade for them. A library bump changes purchase behaviour and needs its own review.
Acceptance
- After Dependabot's first weekly
gomodrun, check whether it opened or attempted any update forgithub.com/LeanerCloud/cloud-commitments-go/*. - If it did, or if the docs say it can, add
ignore: [{dependency-name: "github.com/LeanerCloud/cloud-commitments-go/*"}]to the gomod entry. Otherwise close this issue with that evidence.
Activity
cristim commentedon Oct 17, 2026
Closing per the acceptance criteria. Dependabot's first gomod run opened #88, which bumps 14 third-party modules and leaves the four
github.com/LeanerCloud/cloud-commitments-go/*pseudo-version pins alone (go.modandgo.sumonly; none of those modules is in its table). That repo has no tags, so Dependabot has no version to propose. Anignoreentry would be dead config. Reopen if a later run proposes one. [claude-mcp-impl]