Group dependabot version updates by ecosystem - #395
Merged
Conversation
Only the npm ecosystem had grouping configured, so github-actions, uv, and gomod each opened one PR per dependency. A single otel release produced three separate PRs carrying an identical go.mod/go.sum diff, and a routine week produced thirteen open PRs. Each of the three now groups minor and patch bumps into one PR: - github-actions: one "actions" group across all workflows - uv: split into "python-runtime" and "python-dev" so a runtime bump that reaches published-package users stays separable from tooling - gomod: one "go-modules" group Major bumps stay ungrouped and arrive as individual PRs, so a higher-risk upgrade is still reviewed and revertible on its own. npm grouping is unchanged.
|
docfacts: no documented claims affected. |
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Only the
npmecosystem had grouping configured.github-actions,uv, andgomodopened one PR per dependency, which is how a single otel 1.46.0 release turned into three separate PRs (#384, #385, #386) carrying a byte-identicalgo.mod/go.sumdiff, and how a routine week accumulated thirteen open dependabot PRs.What changed
.github/dependabot.ymlonly. Each of the three ungrouped ecosystems now collapses minor and patch bumps into a single PR:github-actions: oneactionsgroup covering every workflowuv: split intopython-runtime(production) andpython-dev(development), so a bump that reaches published-package users stays separable from tooling churngomod: onego-modulesgroupMajor bumps are deliberately excluded from every group, so they still arrive as individual PRs and stay reviewable and revertible on their own.
actions/github-scriptv7 to v9 is the kind of upgrade that should not ride along with five unrelated patches.npmgrouping is left exactly as it was.Test plan
Config-only change, no SDK code touched. Full local suite run on this tree anyway:
make node-check: 35 files, 732 tests passedmake cli-check: 53 files, 808 tests passedmake go-check: gofmt, vet, tests passmake python-check: 348 passedmake python-build: twine check PASSED on wheel and sdistmake shared-check: cross-SDK fixtures pass in all three SDKs.github/dependabot.ymlparses as valid YAMLThe grouping itself is validated by GitHub when dependabot next runs. Worth a glance at the repo's Dependabot tab after merge to confirm no config error, since an invalid file silently stops all updates.