opensource/WeKnora
3
0
Fork 0
mirror of https://github.com/Tencent/WeKnora.git synced 2026-09-19 02:18:25 +08:00
Code Issues Packages Projects Releases Wiki Activity

ci(deps): apply dependabot grouping + monthly cadence across all ecosystems

Browse Source 
Earlier per-dep dependabot PRs against the existing cli/, frontend/,
and miniprogram/ ecosystems flooded the review queue with 40+ PRs at
once. Apply a noise-bounding pattern uniformly to every ecosystem the
repo declares:

  * **Monthly schedule** for routine version updates. Mirrors caddy /
    hashicorp-terraform-actions: explicitly chosen over weekly to keep
    maintainer review-attention bounded for a contributor-driven OSS
    project. Among 10 surveyed mainstream configs (daily 7 / weekly 1
    / monthly 2), monthly is the canonical "minimum-noise" choice for
    the contributor cadence WeKnora actually has.
  * **Two `groups` per ecosystem** so per-dep PRs never flood:
      - `<scope>-deps`        bundles minor + patch updates → ONE PR
                              per ecosystem per month.
      - `<scope>-deps-major`  bundles semver-major bumps the same way.
                              Mirrors grafana's `*-breaking` pattern:
                              surfaces breaking changes as a single
                              review-required PR rather than silently
                              ignoring them. (gh-cli's `ignore:
                              semver-major` style means majors never
                              surface until someone manually edits
                              the .yml or the dep — easier to forget
                              than to act on. Grouping forces them
                              into the review queue.)
  * `open-pull-requests-limit: 3` (was default 5) as a safety net so a
    stalled review queue can't pile up stale group PRs.
  * `commit-message.prefix: "chore(deps)"` so dependabot PR titles
    match the repo's Conventional Commits style out of the box.
    npm gets `prefix-development: "chore(deps-dev)"` for devDependency
    bumps.
  * Note: GitHub Security Advisory CVEs open immediately regardless of
    `schedule.interval` — that field governs *version* updates only,
    so the monthly cadence does NOT delay CVE response.

Coverage:
  - gomod: /, /cli, /client
  - npm:   /frontend, /miniprogram
  - pip:   /docreader
  - github-actions: /

Realistic steady-state with this config: 1–3 grouped PRs per month
total across all 7 ecosystems (vs. 40+ before), with major bumps
appearing as their own group PR every few months when upstream cuts
breaking releases.

Tests / build: not affected (config-only change). YAML validated with
`python3 -c "import yaml; yaml.safe_load(...)"`.
This commit is contained in:
nullkey
2026-05-12 13:20:42 +08:00
committed by lyingbug
parent bdbd15bf75
commit 93d6fb9f30
1 changed files with 117 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/dependabot.yml
+117 -32
View File
@@ -1,63 +1,148 @@
# Dependabot configuration for the WeKnora repository.
#
# Weekly schedule across all ecosystems. Semver-major upgrades are ignored to
# reduce noise; major bumps are routed through manual review.
# Conventions applied to every ecosystem:
#
# * Monthly schedule (one batch / month, predictable maintenance window).
# Mirrors caddy / hashicorp-terraform-actions: explicitly chosen over
# weekly to keep maintainer review-attention bounded; among 10 surveyed
# mainstream OSS configs (daily 7 / weekly 1 / monthly 2) monthly is
# the canonical "minimum-noise" choice for contributor-driven projects.
# CVE security updates open immediately regardless of this cadence —
# `schedule.interval` governs *version* updates only.
# * Two `groups` per ecosystem so per-dep PRs never flood:
# - `<scope>-deps` bundles minor + patch updates → ONE PR
# per ecosystem per month.
# - `<scope>-deps-major` bundles semver-major bumps the same way.
# Mirrors grafana's `*-breaking` pattern:
# surfaces breaking changes as a single
# review-required PR rather than silently
# ignoring them (which an earlier draft
# attempted via `ignore: semver-major`,
# but the gh-cli pattern means majors
# never surface until someone manually
# acts — easier to forget than to do).
# * `open-pull-requests-limit: 3` as a safety net so a stalled review
# queue can't accumulate stale group PRs (default is 5).
# * `commit-message.prefix` set to "chore(deps)" so dependabot PRs
# match the repo's Conventional Commits convention out of the box.
# npm gets `prefix-development: "chore(deps-dev)"` for devDependency
# bumps.
#
# Adopting these uniformly was driven by an earlier flood of per-dep PRs
# (40+) after the initial scan opened against cli/, frontend/, and
# miniprogram/ before grouping was configured. Realistic steady-state
# now: 1–3 PRs / month total across all 7 ecosystems, plus an occasional
# `<scope>-deps-major` PR every few months when upstream cuts a breaking
# release.
version: 2
updates:
# Go modules
# ─── Go modules ───
- package-ecosystem: gomod
directory: "/"
schedule:
interval: weekly
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major"]
interval: monthly
open-pull-requests-limit: 3
commit-message:
prefix: "chore(deps)"
groups:
server-deps:
patterns: ["*"]
update-types: ["minor", "patch"]
server-deps-major:
patterns: ["*"]
update-types: ["major"]
- package-ecosystem: gomod
directory: "/cli"
schedule:
interval: weekly
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major"]
interval: monthly
open-pull-requests-limit: 3
commit-message:
prefix: "chore(deps)"
groups:
cli-deps:
patterns: ["*"]
update-types: ["minor", "patch"]
cli-deps-major:
patterns: ["*"]
update-types: ["major"]
- package-ecosystem: gomod
directory: "/client"
schedule:
interval: weekly
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major"]
interval: monthly
open-pull-requests-limit: 3
commit-message:
prefix: "chore(deps)"
groups:
client-deps:
patterns: ["*"]
update-types: ["minor", "patch"]
client-deps-major:
patterns: ["*"]
update-types: ["major"]
# ─── npm ───
- package-ecosystem: npm
directory: "/frontend"
schedule:
interval: weekly
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major"]
interval: monthly
open-pull-requests-limit: 3
commit-message:
prefix: "chore(deps)"
prefix-development: "chore(deps-dev)"
groups:
frontend-deps:
patterns: ["*"]
update-types: ["minor", "patch"]
frontend-deps-major:
patterns: ["*"]
update-types: ["major"]
- package-ecosystem: npm
directory: "/miniprogram"
schedule:
interval: weekly
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major"]
interval: monthly
open-pull-requests-limit: 3
commit-message:
prefix: "chore(deps)"
prefix-development: "chore(deps-dev)"
groups:
miniprogram-deps:
patterns: ["*"]
update-types: ["minor", "patch"]
miniprogram-deps-major:
patterns: ["*"]
update-types: ["major"]
# Python
# ─── Python ───
- package-ecosystem: pip
directory: "/docreader"
schedule:
interval: weekly
ignore:
- dependency-name: "*"
update-types: ["version-update:semver-major"]
interval: monthly
open-pull-requests-limit: 3
commit-message:
prefix: "chore(deps)"
groups:
docreader-deps:
patterns: ["*"]
update-types: ["minor", "patch"]
docreader-deps-major:
patterns: ["*"]
update-types: ["major"]
# GitHub Actions
# ─── GitHub Actions ───
- package-ecosystem: github-actions
directory: "/"
schedule:
interval: weekly
interval: monthly
open-pull-requests-limit: 3
commit-message:
prefix: "chore(deps)"
groups:
gha-deps:
patterns: ["*"]
update-types: ["minor", "patch"]
gha-deps-major:
patterns: ["*"]
update-types: ["major"]