chore(deps): add Dependabot dependency-update routine (LAC-3320) - #44
Open
lacymorrow wants to merge 1 commit into
Open
chore(deps): add Dependabot dependency-update routine (LAC-3320)#44lacymorrow wants to merge 1 commit into
lacymorrow wants to merge 1 commit into
Conversation
Backfills the Dependabot config from shipkit (LAC-3319) into bones so downstream sites inherit weekly grouped dependency PRs via upstream sync. - .github/dependabot.yml: weekly Monday PRs, grouped minor/patch for prod and dev, individual major bumps, plus a github-actions ecosystem entry. Adapted for bones: no /cli subpath, pnpm-lock.yaml note. - docs/development/dependency-updates.mdx: documents the automated cadence and the manual pnpm-based escape hatch.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backfills the Dependabot config from shipkit (LAC-3319 / PR #278) into bones so every downstream Shipkit site inherits the weekly dependency-update cadence via upstream sync.
.github/dependabot.yml— weekly Monday PRs, grouped minor/patch for prod and dev, individual major bumps, plus agithub-actionsecosystem entry.docs/development/dependency-updates.mdx— documents the automated cadence and the manualpnpm-based escape hatch.Adapted from the shipkit version for bones: dropped the
/clisubpath (bones has no CLI package), swapped the Bun lockfile note forpnpm-lock.yaml, and rewrote the manual-update commands aspnpm run ….Paperclip: LAC-3320
Parent: LAC-3319
Test plan
sync-upstreamruns pull the config into shipkit family repos on their next sync.🤖 Generated with Claude Code