From 9b3ba65aadbb8c2fc8be15a23eaad5fc56ab10ff Mon Sep 17 00:00:00 2001 From: forkwright Date: Mon, 24 Aug 2026 11:05:36 -0500 Subject: [PATCH] chore(deps): watch all three graphs from one dependabot entry The three cargo entries here covered the right graphs and produced PRs that could not land. A version declared in the root manifest spans all three lockfiles, but each entry regenerates only its own, so every PR left the other two stale against the manifest they resolve from and failed this repo's drift gates. The smoltcp 0.14 bump arrived as #923, #924 and #925 -- three PRs, none mergeable alone, consolidated by hand into #926. `directories` (plural) watches the same three graphs from a single entry and groups them into one PR. Verified against aletheia, which already uses this form: its #6897 is titled "bump the patch-updates group across 2 directories" and carries both Cargo.lock and fuzz/Cargo.lock in one diff. The coverage rationale the previous comment recorded is preserved, because it was right and was learned expensively: watching only `/` is how fuzz/Cargo.lock drifted nine releases with two path-dependencies missing (#768). This changes how the coverage is expressed, not how much there is. --- .github/dependabot.yml | 62 +++++++++++++++--------------------------- 1 file changed, 22 insertions(+), 40 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f8a608af..361717d6 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,47 +1,29 @@ version: 2 -# WHY three cargo entries where the rest of the fleet has one: thumos carries -# three independent dependency graphs, each with its own lockfile. The kernel -# crate is excluded from the workspace so it can cross-compile bare-metal to -# armv7a-none-eabi, and fuzz/ declares its own empty [workspace] because -# cargo-fuzz requires nightly. A config watching only `/` leaves the other two -# unwatched -- which is how fuzz/Cargo.lock drifted nine releases with two -# path-dependencies missing entirely, invisible to cargo audit and cargo deny -# the whole time (#768). - +# WARNING: `directories`, not `directory`. thumos carries three independent +# dependency graphs, each with its own lockfile: the kernel crate is excluded +# from the workspace so it can cross-compile bare-metal to armv7a-none-eabi, +# and fuzz/ declares its own empty [workspace] because cargo-fuzz requires +# nightly. A config watching only `/` leaves the other two unwatched -- which is +# how fuzz/Cargo.lock drifted nine releases with two path-dependencies missing +# entirely, invisible to cargo audit and cargo deny the whole time (#768). +# +# One entry listing all three, rather than three entries each watching one. +# Three separate entries cover the same graphs but guarantee a SEPARATE PR per +# directory, and a version bump declared in the root manifest spans all three -- +# so each PR regenerates one lockfile, leaves the other two stale against the +# manifest they resolve from, and fails this repo's own drift gates. None of +# them can pass alone. That is what happened to the smoltcp 0.14 bump: three +# PRs (#923, #924, #925), none mergeable, consolidated by hand into #926. +# +# A new excluded workspace needs a row here -- nothing fails when one is +# missing, which is why both went unnoticed the first time. updates: - package-ecosystem: cargo - directory: / - schedule: - interval: weekly - day: monday - open-pull-requests-limit: 10 - groups: - patch-updates: - update-types: [patch] - minor-updates: - update-types: [minor] - reviewers: - - forkwright - - # Kernel crate: excluded from the workspace, own Cargo.lock. - - package-ecosystem: cargo - directory: /crates/thumos - schedule: - interval: weekly - day: monday - open-pull-requests-limit: 10 - groups: - patch-updates: - update-types: [patch] - minor-updates: - update-types: [minor] - reviewers: - - forkwright - - # Fuzz targets: own [workspace], own Cargo.lock, nightly-only. - - package-ecosystem: cargo - directory: /fuzz + directories: + - / + - /crates/thumos + - /fuzz schedule: interval: weekly day: monday