Repository navigation
Stop paying two pull requests for every unchanged settings-publisher release #890
Description
🤖 Generated by the Agentic Engineer
Problem
Every release of this repository's own publishing workflow makes Dependabot open a bump of the organization settings caller, and every one of those bumps is refused on purpose until the platform approves the new signer revision. Each bump therefore costs two coordinated pull requests (a platform approval, then an adaptation of the bump), a merge-queue wait between them, and a review on each — even when, as in every case so far, the publishing workflow and its helpers are byte-identical and only the signer identity moves.
Evidence
- Six such bumps in ten days: fix(deps): bump devantler-tech/.github/.github/workflows/publish-manifests.yaml from 10.0.3 to 19.0.3 #818, fix(deps): bump devantler-tech/.github/.github/workflows/publish-manifests.yaml from 19.0.3 to 19.0.8 #831, fix(deps): bump devantler-tech/.github/.github/workflows/publish-manifests.yaml from 19.0.8 to 20.0.3 #855, fix(deps): bump devantler-tech/.github/.github/workflows/publish-manifests.yaml from 20.0.3 to 20.1.6 #877, fix(deps): bump devantler-tech/.github/.github/workflows/publish-manifests.yaml from 20.1.6 to 20.1.12 #884 and fix(deps): bump devantler-tech/.github/.github/workflows/publish-manifests.yaml from 20.1.12 to 20.1.17 #889 (v10.0.3 → v20.1.17).
- fix(deps): bump devantler-tech/.github/.github/workflows/publish-manifests.yaml from 20.1.6 to 20.1.12 #884 needed platform#5951 first; fix(deps): bump devantler-tech/.github/.github/workflows/publish-manifests.yaml from 20.1.12 to 20.1.17 #889 now needs platform#6004 first.
- The guard's content review passed every time; only the signer half refused.
Hypothesis
If the settings caller moves its signer revision only when the publisher's reviewed content actually changes (or on a slower cadence), the security property — the platform only accepts settings signed by a revision it approved — stays intact, and most of this toil disappears.
Options to evaluate
- Dependabot cadence or grouping for this one caller, so patch releases that do not change the publisher are batched.
- Skip a bump when the guard's content review shows the publisher files are unchanged, keeping the current approved revision.
- Leave the process as is, if the approval itself is judged worth its cost.
Success signal
Fewer platform approval pull requests per month for the settings publisher, with no change to the platform's signer verification.
Acceptance criteria
- A decision recorded here, and the chosen change shipped behind the existing guard without weakening it.
Size: small to medium.
Activity
devantler commentedon Nov 10, 2026
Refinement: what each option touches
I read the options against the current configuration and did not ship a change, because each one reaches further than the issue's "small to medium" suggests:
Suggested next step: take the ignore option with both pieces (the manifest entry and the content-drift signal) as one change, and keep the guard unchanged. The success signal is still the monthly count of platform approval pull requests for the settings publisher.
🤖 Generated with Claude Code