Improve Dependabot configuration and coverage - #2477
Merged
Conversation
Security updates were never grouped: `groups` defaults to `applies-to: version-updates`, so every advisory - including transitive ones - arrived as its own PR. That accounted for most of the noise. Also fixes the `react` group, which never matched `react` itself, and splits the production/development catch-alls to minor/patch so a single breaking major cannot block an otherwise-mergeable batch. Adds family groups for the largest dependency families in the root manifest. npm moves to a Mon/Thu cron in Europe/Prague; cron cannot express "every 3 days" and a day-of-month step breaks at month boundaries. Docker and Actions stay weekly - they produce far fewer updates and every run costs a full CI cycle. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Dependabot now watches Dockerfile and worker.Dockerfile, which were previously unmanaged. It does not touch .nvmrc, so the Node version was free to drift across the four places it is pinned. check-node-version.sh asserts every Dockerfile stage agrees and that .nvmrc matches; --fix syncs .nvmrc from the Dockerfiles and refuses to run when the Dockerfiles disagree. The CI job mirrors the existing check-licenses shape: fail with a hint, then auto-commit on dependabot/ branches so the bump lands as one coherent PR. Also annotates two SHA-pinned actions with their resolved versions. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Each SHA was resolved against the upstream repository's tag list. Without the trailer, Dependabot's PRs for these pins are unreadable. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The script is bash-shebanged, so there is no portability reason to prefer [. [[ ]] avoids word splitting and glob expansion on unquoted operands. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The Dependabot cron schedule keys in .github/dependabot.yml appear invalid (cronjob/timezone), which can silently disable Dependabot updates.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR reduces Dependabot noise and improves update batching across npm, Docker, and GitHub Actions; it also adds CI automation to keep .nvmrc aligned with Node versions pinned in Dockerfiles, and annotates SHA-pinned actions with human-readable version trailers.
Changes:
- Refactors
.github/dependabot.ymlto add security-update grouping, more granular dependency-family groups, and revised schedules/limits. - Adds
tools/check-node-version.shplus a newcheck-node-versionCI job to detect (and on Dependabot branches, auto-fix + commit).nvmrcdrift vs Dockerfile Node pins. - Adds version trailers to SHA-pinned GitHub Actions
uses:entries for readability.
Blocking
- Dependabot cron scheduling uses
cronjob(andtimezone) underschedule, which is not the expected schema forinterval: 'cron'and is likely to invalidatedependabot.yml(silently halting updates).
Non-blocking
- None
Merge recommendation
- Do not merge
File summaries
| File | Description |
|---|---|
tools/check-node-version.sh |
Adds a Bash check (and --fix) to keep .nvmrc synchronized with Node versions pinned in Dockerfiles. |
.github/workflows/ci.yml |
Introduces a CI job to enforce/sync .nvmrc consistency and adds version trailers to some pinned actions. |
.github/dependabot.yml |
Expands grouping coverage and scheduling behavior for npm/docker/actions updates (contains the blocking cron-key issue). |
.github/workflows/release.yml |
Adds a readable version trailer to a SHA-pinned action reference. |
.github/workflows/pr-reviewer.yml |
Adds a readable version trailer to a SHA-pinned action reference. |
Review details
- Files reviewed: 5/5 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
A mutable tag lets the action's owner change what runs in a job that holds AWS credentials. Pinning to the commit removes that. SHA resolved from the v6.2.4 tag via the git ref and cross-checked against the tag list. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
MarceloRGonc
enabled auto-merge (squash)
September 7, 2026 15:05
MarceloRGonc
disabled auto-merge
September 7, 2026 15:40
|
ravikiranvm
approved these changes
Sep 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes OPS-4799