[issues/688] Add Dependabot config for npm and GitHub Actions#689
Merged
Conversation
## Summary Adds `.github/dependabot.yml` to automate weekly dependency updates for the pnpm workspace and GitHub Actions. Both ecosystems use grouped PRs to batch all bumps into a single PR per week. Part of an account-wide Dependabot rollout. ## Changes - Dependabot enabled for npm (pnpm workspace) with a weekly Monday schedule, `versioning-strategy: increase`, and one grouped PR matching all dependencies - Dependabot enabled for GitHub Actions with the same schedule and one grouped PR for all action version bumps - `@couimet/*` packages (`@couimet/logger-contract`, `@couimet/logger-contract-testing`) batch with the general deps group since this repo consumes them from npm, unlike the publisher repo which excludes them as workspace deps ## Key Discoveries - The issue body stated no `@couimet/*` dependencies existed, but `@couimet/logger-contract` and `@couimet/logger-contract-testing` are consumed by two packages. No `exclude-patterns` for `@couimet/*` was added — they batch with the general group, matching the parent issue's goal of tracking first-party package releases. ## Test Plan - [ ] All existing tests pass (pre-existing `@couimet/detailed-error-testing` module resolution failure is unrelated — confirmed identical with and without this change) - [ ] New tests added for: none (config file only) - [ ] Manual testing: Dependabot validates the config on merge; YAML syntax confirmed valid via `python3 -c "import yaml; yaml.safe_load(...)"` ## Related - Closes #688 - Parent: couimet/idea-garden#11 Generated by /finish-issue v2026.07.14.3@8469237 • [my-claude-skills](https://github.com/couimet/my-claude-skills) @coderabbitai ignore
✅ CI / Integration Tests (with overrides) — run summaryDuration: 1m 1s QA TC IDs: 2 exercised across 0 features Report: View run & artifacts Reproduce locally: Feature breakdown
|
Coverage Report
|
TODO/FIXME Analysis
|
✅ CI / Integration Tests (automated) — run summaryDuration: 11m 39s QA TC IDs: 164 exercised across 0 features Report: View run & artifacts Reproduce locally: Feature breakdown
|
✅ CI / Integration Tests (with extensions) — run summaryDuration: 13m 48s Unit tests: Ran in separate Test & Validate job QA TC IDs: 196 exercised across 0 features Report: View run & artifacts Reproduce locally: Feature breakdown
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
.github/dependabot.ymlto automate weekly dependency updates for the pnpm workspace and GitHub Actions. Both ecosystems use grouped PRs to batch all bumps into a single PR per week. Part of an account-wide Dependabot rollout.Changes
versioning-strategy: increase, and one grouped PR matching all dependencies@couimet/*packages (@couimet/logger-contract,@couimet/logger-contract-testing) batch with the general deps group since this repo consumes them from npm, unlike the publisher repo which excludes them as workspace depsKey Discoveries
@couimet/*dependencies existed, but@couimet/logger-contractand@couimet/logger-contract-testingare consumed by two packages. Noexclude-patternsfor@couimet/*was added — they batch with the general group, matching the parent issue's goal of tracking first-party package releases.Test Plan
@couimet/detailed-error-testingmodule resolution failure is unrelated — confirmed identical with and without this change)python3 -c "import yaml; yaml.safe_load(...)"Related
Generated by /finish-issue v2026.07.14.3@8469237 • my-claude-skills
@coderabbitai ignore