chore(deps): add the fleet dependabot config - #116
Merged
Conversation
This repository had no .github/dependabot.yml, so it has never received a dependency update. Eight of fourteen audited fleet repos were in that state. The absence is silent by nature: a repo with no config looks exactly like one whose dependencies happen to be current. It cannot be fixed at the org level. Unlike community health files, Dependabot does not inherit a config from the .github repository -- version updates require a per-repo file. Matches the fleet form: weekly, patch and minor grouped separately so a green group merges as one PR, github-actions watched alongside the package ecosystem, forkwright on review. The WARNING about enumerating every lockfile is carried deliberately. A dependency graph watched by no entry never updates, and nothing reports it -- thumos lost nine releases of fuzz/Cargo.lock exactly that way. Root cause of the class is kanon#3640: the CI template ships dependabot-auto-merge.yml, the workflow that MERGES dependency PRs, and no dependabot.yml to produce any. Every repo scaffolded from canon inherits an auto-merger with nothing to merge.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This repository has no
.github/dependabot.yml, so it has never received a dependency update.Eight of fourteen audited fleet repos are in that state — typikon, logismos, epitelesis, koinon, sphragis, kanon, gnomon, dioptron. The absence is silent by nature: a repo with no config looks exactly like one whose dependencies happen to be current.
It cannot be fixed at the org level. Unlike community health files (
SECURITY.md,CONTRIBUTING.md), Dependabot does not inherit a config from the.githubrepository — version updates require a per-repo file.What this adds
The fleet form, matching aletheia and harmonia:
github-actionswatched alongside the package ecosystemforkwrighton reviewThe warning in the file is load-bearing
Every lockfile needs its own row. A dependency graph watched by no entry never updates, and nothing reports it —
thumoslost nine releases offuzz/Cargo.lockexactly that way, with two path-dependencies missing entirely and invisible tocargo auditandcargo denythe whole time (forkwright/thumos#768).Where a repo has more than one lockfile the correct form is
directories(plural) in one entry, not one entry per directory. Three separate entries cover the same graphs but guarantee a separate PR each, and a bump declared in the root manifest spans all of them — so every PR regenerates one lockfile, leaves the others stale, and fails the repo's drift gates. That is exactly what happened to thumos's smoltcp bump (#923/#924/#925, none mergeable, hand-consolidated into #926, config fixed in #927).Root cause of the class
kanon#3640:
workflow/templates/ci/shipsdependabot-auto-merge.yml— the workflow that merges dependency PRs — and nodependabot.ymlto produce any. Every repo scaffolded from canon inherits an auto-merger with nothing to merge. Fixing the template is tracked there; this PR fixes the instance.Scope
One file. No dependency versions change here — this is the mechanism that will propose them.