From e2883d10e43afb94a7255cac5e6fc2cae2fe061d Mon Sep 17 00:00:00 2001 From: James Manuel Date: Mon, 3 Aug 2026 16:00:49 +0200 Subject: [PATCH] ci(dependabot): group updates and disable npm auto-rebase MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The js/ build output is committed, and npm-build.yml fails when the working tree is dirty after a build. Every bundled-dependency bump therefore makes the committed assets stale, and the pull request needs a /compile comment before it can go green. Worse, every merge to a target branch invalidates the committed assets on all the other open pull requests, so a backlog of N bumps is up to N sequential rebase/compile/merge cycles rather than N compiles. There are 14 open Dependabot pull requests, 9 against main and 5 against stable34. Grouping, by class of update: - npm-production and npm-development split the direct dependencies, so a bundle regression narrows to one half rather than needing a bisect across everything in a single pull request, each attempt costing a /compile. Majors stay ungrouped on main so they still get individual review; on stable34 the existing ignore rule already limits updates to patches. - npm-security is separate because a group applies only to version updates unless applies-to says otherwise. That matters here more than it looks: npm indirect dependencies are not covered by version updates at all, so they reach us solely as security updates. Those are exactly the bundled runtime bumps that need a /compile — immutable, fast-uri, postcss, axios and dompurify have all arrived that way — and security updates are also exempt from open-pull-requests-limit, so nothing else in this file bounds them. Grouping them is the change with the most effect on /compile cycles. - The composer groups set group-by: dependency-name because grouping is otherwise per-directory, which would still produce one pull request per vendor-bin/* tool. Also disable automatic rebasing for npm. A rebase without a recompile leaves CI red regardless, so rebasing every open pull request on each merge only burns CI runs across the whole queue. This disables Dependabot's automatic rebasing only; a manual @dependabot rebase still works, which is what the /compile flow relies on. Two caveats worth recording: the option covers security updates as well as version updates, and pull requests opened before it lands keep being rebased until 30 days after they were opened, so the saving arrives gradually rather than at once. Composer keeps auto-rebase, since those pull requests pass without a recompile. The cooldown is mostly alignment with nextcloud/server rather than a lever in its own right: Dependabot already applies a default 3-day cooldown to version updates, and never applies one to security updates. The stable34 schedule is offset by thirty minutes so the two branch queues do not land simultaneously and stale each other's assets. On precedent: nextcloud/server has the same committed-build-output constraint, and rebase-strategy: "disabled" on npm ("without a build CI will likely fail anyway") and cooldown are taken from its configuration. Its grouping is deliberately narrower — three tool-family patterns, no catch-all, composer ungrouped — because its npm churn concentrates in eslint, vite and vitest. Office's does not, so family patterns would barely reduce the count here. The broader grouping is this repository's own call rather than something server endorses. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: James Manuel --- .github/dependabot.yml | 69 ++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 67 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5fd0b4e..5e128ca 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -10,6 +10,16 @@ updates: time: "03:00" timezone: Europe/Paris open-pull-requests-limit: 10 + groups: + composer: + # Without group-by, grouping is per-directory, so each vendor-bin/* + # tool would still get its own pull request. + group-by: dependency-name + patterns: + - "*" + update-types: + - minor + - patch - package-ecosystem: npm directory: "/" schedule: @@ -18,15 +28,65 @@ updates: time: "03:00" timezone: Europe/Paris open-pull-requests-limit: 10 + # Assets are committed, so a rebase without a recompile leaves CI red + # anyway. Rebase manually alongside /compile when a pull request is ready + # to merge — this only disables Dependabot's automatic rebasing. + rebase-strategy: "disabled" + cooldown: + default-days: 4 + semver-major-days: 8 + # Groups are first-match. production/development split the direct + # dependencies so a bundle regression narrows to one half. npm-security is + # separate because groups only apply to version updates unless applies-to + # says otherwise, and indirect dependencies reach us solely as security + # updates — which are also exempt from open-pull-requests-limit, so they + # are the class most worth grouping. + groups: + npm-production: + dependency-type: production + patterns: + - "*" + update-types: + - minor + - patch + npm-development: + dependency-type: development + patterns: + - "*" + update-types: + - minor + - patch + npm-security: + applies-to: security-updates + patterns: + - "*" - package-ecosystem: npm directory: "/" schedule: interval: weekly day: saturday - time: "03:00" + # Offset from main's queue so both branches do not land at once and + # stale each other's committed assets. + time: "03:30" timezone: Europe/Paris target-branch: stable34 open-pull-requests-limit: 10 + rebase-strategy: "disabled" + cooldown: + default-days: 4 + groups: + npm-production: + dependency-type: production + patterns: + - "*" + npm-development: + dependency-type: development + patterns: + - "*" + npm-security: + applies-to: security-updates + patterns: + - "*" ignore: # do not do breaking changes on stable branches - dependency-name: "*" @@ -38,10 +98,15 @@ updates: schedule: interval: weekly day: saturday - time: "03:00" + time: "03:30" timezone: Europe/Paris target-branch: stable34 open-pull-requests-limit: 10 + groups: + composer: + group-by: dependency-name + patterns: + - "*" ignore: # do not do breaking changes on stable branches - dependency-name: "*"