Repository navigation
chore: group Dependabot updates and auto-merge safe ones - #92
Merged
Merged
Conversation
Groups NuGet minor/patch bumps into a single PR and security updates into another, and moves github-actions updates to monthly in one group. Adds a workflow that enables auto-merge for third-party minor and patch bumps once the required check passes. Majors and inter-repo CDS.* bumps are labelled needs-review rather than merged: release_sweep.ps1 merges those in dependency order, and landing one early can break a downstream repo's restore. Already fully SHA-pinned, so no action changes here. Makes NU1903/NU1904 build errors in CI only. Co-Authored-By: Claude Opus 5 <noreply\@anthropic.com>
There was a problem hiding this comment.
🟡 Changes recommended
The critical workflow permission issue and moderate Dependabot grouping issue must be fixed before approval.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Configures Dependabot grouping, safe auto-merge automation, and CI-only NuGet vulnerability enforcement.
Changes:
- Groups NuGet and GitHub Actions updates.
- Adds Dependabot labeling and auto-merge logic.
- Promotes high/critical NuGet advisories to CI errors.
File summaries
| File | Summary |
|---|---|
Directory.Build.props |
Configures NuGet auditing and CI warning escalation. |
.github/workflows/dependabot-automerge.yml |
Adds labeling and auto-merge logic. Critical: pull_request tokens are read-only, preventing write operations; use a privileged trigger. |
.github/dependabot.yml |
Defines update schedules and groups. Moderate: Add applies-to: version-updates to prevent security updates entering the minor/patch group. |
Review details
Suppressed comments (1)
.github/dependabot.yml:19
- A group without
applies-tomatches both version and security updates, so a minor/patch security update can be consumed bynuget-minor-patchinstead of the separatenuget-securitygroup. Addapplies-to: version-updateshere to make the two groups mutually exclusive as described.
nuget-minor-patch:
patterns: [ "*" ]
update-types: [ "minor", "patch" ]
- Files reviewed: 3/3 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| @@ -0,0 +1,41 @@ | |||
| name: Dependabot auto-merge | |||
|
|
|||
| on: pull_request | |||
gh pr edit --add-label writes issue labels, but this workflow's explicit permissions block granted no issues scope at all, so the needs-review path would have 403'd on the first major or inter-repo CDS.* bump -- silently losing the routing that keeps release_sweep.ps1 in dependency order. Grants issues: write and calls the labels endpoint through gh api directly, which also avoids gh pr edit's projectCards query (cli/cli#6274, still open). Found by Copilot review. The same review's pull_request_target recommendation was declined: Dependabot-triggered pull_request runs have respected the permissions key since 2021-10-11, and pull_request_target would be worse. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Applies the fleet-wide Dependabot automation agreed 2026-09-16. Same shape as CDS.ImageDisplay#39, which is merged.
Dependabot config
applies-to: security-updates). Majors stay ungrouped so they arrive individually for review.github-actionsmoved from weekly to monthly, all in one group.reviewers:(no longer in the Dependabot options reference); keptlabels:/assignees:, whichrelease_sweep.ps1relies on for PR discovery and its label preflight.dotnet-sdkentry — it only acts on ansdk.versioninglobal.json, which no repo here pins.Auto-merge workflow
Enables auto-merge for third-party minor and patch bumps once the required check passes. Majors, and any inter-repo
CDS.*bump, are labelledneeds-reviewinstead —release_sweep.ps1merges those in dependency order, and landing one early can break a downstream repo's restore.NuGet audit
NuGetAudit/NuGetAuditMode=allmade explicit, with NU1903/NU1904 (high/critical) promoted to errors in CI only, so a newly published advisory never blocks local work.Standards doc updated in
dev-central(85f597b).🤖 Generated with Claude Code