From a483f6c0fde64b0b7ad8952422d255b5cf7d51c8 Mon Sep 17 00:00:00 2001 From: Mohammed Alshahrani Date: Tue, 9 Jun 2026 04:54:45 +0300 Subject: [PATCH 1/3] CI: scope CompatHelper GITHUB_TOKEN to least privilege Add an explicit permissions block (contents: write, pull-requests: write) to CompatHelper.yml, narrowing this workflow's token from the repo-wide write default. Complements enabling the repo policy 'Allow GitHub Actions to create and approve pull requests' (Settings > Actions > General), which was the actual fix for the recurring CompatHelper 403 on PR creation. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/CompatHelper.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/CompatHelper.yml b/.github/workflows/CompatHelper.yml index 2eaa139..bd79fbc 100644 --- a/.github/workflows/CompatHelper.yml +++ b/.github/workflows/CompatHelper.yml @@ -3,6 +3,14 @@ on: schedule: - cron: 0 0 * * * workflow_dispatch: +# Least-privilege: scope this workflow's GITHUB_TOKEN to exactly what +# CompatHelper needs (read the repo, open the compat PR) instead of the +# repo-wide `write` default. PR *creation* is additionally gated by the +# repo setting "Allow GitHub Actions to create and approve pull requests" +# (Settings > Actions > General > Workflow permissions), enabled 2026-06-09. +permissions: + contents: write + pull-requests: write jobs: CompatHelper: runs-on: ubuntu-latest From 3728d840609bd21f28a86ff2a4680955a1d61d14 Mon Sep 17 00:00:00 2001 From: Mohammed Alshahrani Date: Tue, 9 Jun 2026 05:02:41 +0300 Subject: [PATCH 2/3] Compat: allow SciMLBase 3.x Widen SciMLBase from "2.53" to "2.53, 3". CI-verified compatible: the full 262-test suite plus docs build pass against SciMLBase 3.x across Julia 1.10/1.12/pre on x64+x86 (CompatHelper PR #21). The package's SciMLBase usage is limited to stable API (NonlinearProblem, isinplace, ReturnCode, NLStats, build_solution, __solve), unaffected by the 2.x -> 3.x major bump. Co-Authored-By: Claude Opus 4.8 (1M context) --- Project.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Project.toml b/Project.toml index 767038e..14fe618 100644 --- a/Project.toml +++ b/Project.toml @@ -13,7 +13,7 @@ SciMLBase = "0bca4576-84f4-4d90-8ffe-ffa030f20462" [compat] CommonSolve = "0.2" LineSearch = "0.1" -SciMLBase = "2.53" +SciMLBase = "2.53, 3" julia = "1.10" [extras] From f43da65bab2985a7907f9a89360350150560cc0b Mon Sep 17 00:00:00 2001 From: Mohammed Alshahrani Date: Tue, 9 Jun 2026 05:02:41 +0300 Subject: [PATCH 3/3] CI: drop Dependabot julia ecosystem in favor of CompatHelper CompatHelper and Dependabot's julia ecosystem were both managing Julia dependencies, producing duplicate PRs (e.g. the same SciMLBase bump as #16 and #21). Standardize on CompatHelper (registry-aware, the Julia-ecosystem norm). Keep the github-actions ecosystem, which CompatHelper does not cover. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/dependabot.yml | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5f06744..d0bb828 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -10,15 +10,7 @@ updates: # github-actions: # patterns: # - "*" - - package-ecosystem: "julia" - directories: - - "/" - - "/docs" - - "/test" - schedule: - interval: "weekly" - # To group all Julia dependency updates into a single PR, uncomment the following: - # groups: - # julia-dependencies: - # patterns: - # - "*" + # Julia dependency updates are handled by CompatHelper + # (.github/workflows/CompatHelper.yml) — the registry-aware Julia-ecosystem + # standard — so a "julia" package-ecosystem is intentionally NOT declared here + # to avoid duplicate PRs. Do not re-add one.