From 705b90f9c49b80c1a436247052c8b63f9989375b Mon Sep 17 00:00:00 2001 From: Ralf Anton Beier Date: Wed, 16 Sep 2026 07:28:52 +0200 Subject: [PATCH] Dependency updates, with nothing to keep in step by hand MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replaces varve#2, which was closed rather than merged. That config enumerated cargo directories — `/`, `/crates/varve-core`, `/crates/varve` — and was already wrong when it was opened: `varve-producer` had shipped and was not in the list, and `varve-serve` has since joined it. A hand-maintained enumeration of crates is precisely the drift this repository gates against everywhere else. `mutation-scope.toml` exists because a hand-kept file list went stale and a mutant permitting yank suppression survived; the docs gate enumerates shipped binaries rather than naming them, after naming one of two. Merging a config with the same defect would have been odd. So: ONE cargo entry for the workspace. varve has a single root `Cargo.lock`, which `/` already covers — per-crate entries would raise duplicate, conflicting PRs against that one lockfile and would need adding to whenever a crate is. And `github-actions`, which the old config omitted and which is the ecosystem this repository most needs. Every workflow pins actions by full commit SHA, which is right for a project whose subject is supply-chain integrity and which means they go stale SILENTLY — there is no version constraint anywhere for anything to notice. Dependabot understands the SHA-plus-comment form and keeps them pinned while moving them forward. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_019TNtfRjLNhEz82G2ggeeNu --- .github/dependabot.yml | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..cec7698 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,32 @@ +# Dependency updates, configured so there is nothing to keep in step by hand. +# +# The previous attempt (varve#2) enumerated crate directories — `/`, +# `/crates/varve-core`, `/crates/varve` — and was already wrong when it was +# opened: `varve-producer` had shipped and was missing. A hand-maintained list +# of crates is the drift this repository gates against everywhere else, so this +# does not keep one. +version: 2 +updates: + # ONE entry for the workspace. varve is a Cargo workspace with a single root + # Cargo.lock; per-crate entries would raise duplicate and conflicting PRs + # against that one lockfile, and would need adding to whenever a crate is. + - package-ecosystem: cargo + directory: / + schedule: + interval: weekly + labels: + - dependencies + open-pull-requests-limit: 5 + + # The one that actually matters here. Every workflow pins its actions by full + # commit SHA — `actions/checkout@3d3c42e5…` — which is the right thing for a + # repository whose subject is supply-chain integrity, and which means they go + # stale SILENTLY: there is no version constraint anywhere for anything to + # notice. Dependabot understands the SHA-plus-comment form and keeps it + # pinned while moving it forward. + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + labels: + - dependencies