mirror of
https://github.com/Tencent/WeKnora.git
synced 2026-09-19 10:28:49 +08:00
nullkey
93d6fb9f30
Earlier per-dep dependabot PRs against the existing cli/, frontend/,
and miniprogram/ ecosystems flooded the review queue with 40+ PRs at
once. Apply a noise-bounding pattern uniformly to every ecosystem the
repo declares:
* **Monthly schedule** for routine version updates. Mirrors caddy /
hashicorp-terraform-actions: explicitly chosen over weekly to keep
maintainer review-attention bounded for a contributor-driven OSS
project. Among 10 surveyed mainstream configs (daily 7 / weekly 1
/ monthly 2), monthly is the canonical "minimum-noise" choice for
the contributor cadence WeKnora actually has.
* **Two `groups` per ecosystem** so per-dep PRs never flood:
- `<scope>-deps` bundles minor + patch updates → ONE PR
per ecosystem per month.
- `<scope>-deps-major` bundles semver-major bumps the same way.
Mirrors grafana's `*-breaking` pattern:
surfaces breaking changes as a single
review-required PR rather than silently
ignoring them. (gh-cli's `ignore:
semver-major` style means majors never
surface until someone manually edits
the .yml or the dep — easier to forget
than to act on. Grouping forces them
into the review queue.)
* `open-pull-requests-limit: 3` (was default 5) as a safety net so a
stalled review queue can't pile up stale group PRs.
* `commit-message.prefix: "chore(deps)"` so dependabot PR titles
match the repo's Conventional Commits style out of the box.
npm gets `prefix-development: "chore(deps-dev)"` for devDependency
bumps.
* Note: GitHub Security Advisory CVEs open immediately regardless of
`schedule.interval` — that field governs *version* updates only,
so the monthly cadence does NOT delay CVE response.
Coverage:
- gomod: /, /cli, /client
- npm: /frontend, /miniprogram
- pip: /docreader
- github-actions: /
Realistic steady-state with this config: 1–3 grouped PRs per month
total across all 7 ecosystems (vs. 40+ before), with major bumps
appearing as their own group PR every few months when upstream cuts
breaking releases.
Tests / build: not affected (config-only change). YAML validated with
`python3 -c "import yaml; yaml.safe_load(...)"`.