Repository navigation
chore(repo): make dependabot subjects pass the commit convention - #19
Merged
Merged
Conversation
Root cause: with no commit-message setting, dependabot copies the repository's style and writes chore(deps), as on #17, and deps is not a scope check_commits.sh accepts. The composite action's own entry also puts its directory in the title ("in /.github/actions/setup-mavlink-tooling with N updates"), well past 72 characters. Every dependabot pull request fails Commit Checks, and its subject reaches main in a form the repository's own check rejects. Mechanism: an explicit prefix, chore(repo), which dependabot writes with a colon and a space before every subject and title. A bump touches several workflows and the composite action, so no single workflow's ci scope fits, and the repo area covers repository-wide maintenance. The two entries become one with directories, so the workflows and the composite action bump together in one pull request and no title carries a directory path. The group name ci is short, so the grouped subject, "chore(repo): bump the ci group across 2 directories with 5 updates", stays within 72 characters with the " (#NN)" a squash merge appends. Two cases stay outside the limit, both from dependabot's own wording: a month with a single update gets the title "bump <action> from <old> to <new> in the ci group across 1 directory", which no setting shortens, while dependabot cuts that commit's subject to "chore(repo): bump <action>", which passes and which a squash merge of the one-commit pull request keeps; and from #100 on, a squash-merged subject for both directories comes to 73 characters. Validation: the file validates against the SchemaStore dependabot-2.0 schema, and zizmor 1.30.1 (the pin in workflow_lint.yml) reports no findings. A port of dependabot-core's title and subject code (message_builder.rb, pr_name_prefixer.rb and title_builder.rb at main) over 42 cases (1 to 7 updates, either or both directories, both capitalizations) gives 0 commit subjects that check_commits.sh rejects; with the file as it stands on main every case fails. Titles fail only in the 6 single-update cases, and squash-merged subjects only with three-digit pull request numbers. Assisted-by: Claude-Code:claude-opus-5-5 Signed-off-by: Nuno Marques <nmarques@riis.com>
mrpollo
approved these changes
Oct 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot's pull requests fail Commit Checks, and their subjects reach main in a form the repository's own check rejects. With no commit-message setting, dependabot copies the repository's style and writes
chore(deps): ...(as on #17), butdepsis not a scopecheck_commits.shaccepts, and the composite action's separate entry puts its directory path in the title, well past 72 characters.This sets an explicit
chore(repo)prefix, so every dependabot subject and title readschore(repo): bump .... A bump touches several workflows and the composite action, so no single workflow'sciscope fits, andrepois the area for repository-wide maintenance. The two update entries become one withdirectories, so the workflows and the composite action move together in one pull request and no title carries a directory path. The group is namedciso that the grouped subject,chore(repo): bump the ci group across 2 directories with 5 updates, stays within 72 characters even with the(#NN)a squash merge appends.Wire impact: none.
Two cases stay over the limit, both from dependabot's own wording, which no setting changes. A month with a single update gets a title like
chore(repo): bump actions/checkout from 7.0.1 to 7.0.2 in the ci group across 1 directory; dependabot shortens that commit's subject tochore(repo): bump actions/checkout, which passes, and a squash merge of the one-commit pull request keeps it. From #100 on, a squash-merged subject for both directories comes to 73 characters.Validation:
dependabot.ymlvalidates against the SchemaStore dependabot-2.0 schema, and zizmor 1.30.1 (the pin in workflow_lint.yml) reports no findings. I ported dependabot-core's title and subject code (message_builder.rb,pr_name_prefixer.rbandtitle_builder.rbon main) and ran 42 cases throughcheck_commits.sh(1 to 7 updates, either or both directories, both capitalizations): no commit subject fails, where all 42 fail with the file as it is on main. Titles fail only in the 6 single-update cases, and squash-merged subjects only with three-digit pull request numbers. The first monthly run after the merge is the real check.Assisted-by: Claude-Code:claude-opus-5-5