Repository navigation
ci: Add dependabot configuration - #23
Merged
Merged
Conversation
This repository had none, which is why the googletest submodule sat on a 2016 pin until it was bumped by hand, and why the workflows are still on actions/checkout@v4 and release-please-action@v4 while drudge has moved to v6 and v5. Cover the two things that can go stale here: the googletest submodule and the workflow actions. There is no package-manager ecosystem to track, since the library itself is header-only. Schedule, commit prefixes and labels match the configuration already in use in drudge and gristmill. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a Dependabot configuration to keep GitHub Actions and the googletest git submodule up to date, aligning update cadence/labels with related repositories.
Changes:
- Add
.github/dependabot.ymlwith two update ecosystems:github-actionsandgitsubmodule. - Configure monthly scheduling, commit message prefixes, labels, and PR limits for each ecosystem.
Suppressed comments (1)
.github/dependabot.yml:31
- Same issue here: with
interval: "monthly",daymust be a numeric day-of-month (1–28). A weekday string like "saturday" is not valid for monthly schedules and can cause Dependabot to reject the config.
day: "saturday"
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| directory: "/" | ||
| schedule: | ||
| interval: "monthly" | ||
| day: "saturday" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This repository has no dependabot configuration, while drudge and gristmill both do. That gap has cost something concrete.
Why it matters here
The googletest submodule sat on a December 2016 pin. It was only bumped today, in #8, and only because it had become an outright build failure: that pin declares
cmake_minimum_required(VERSION 2.6.4), which CMake 4.x refuses outright. Nine years of drift, surfacing as a broken build rather than as a routine PR.The workflow actions are behind right now. This repository still uses
actions/checkout@v4andgoogleapis/release-please-action@v4. Drudge has moved tov6andv5, via dependabot PRs. The release-please one is not cosmetic — the v4 to v5 bump is the sort of thing better noticed in a small PR than discovered later.The configuration
Two ecosystems, since there is nothing else to track — the library is header-only and has no package manifest:
gitsubmodulefor googletest.github-actionsfor the workflows.Schedule (monthly), commit-message prefixes (
deps,ci) and labels match what drudge and gristmill already use, so the three repositories behave the same way.I also created the
dependencies,github-actionsandsubmodulelabels in this repository, with the same colours as gristmill's. Dependabot refuses to apply labels that do not exist and leaves a complaint comment on every PR instead — which is exactly what it has been doing on drudge, where the configuration named four labels and none of them had been created.Note
Expect a small burst of PRs on the first run: at least
actions/checkoutv4 to v6 andrelease-please-actionv4 to v5. googletest is currently atv1.16.0from #8, so that one should be quiet for a while.🤖 Generated with Claude Code