ci(dependabot): add version update configuration - #699
Open
kstruempf wants to merge 1 commit into
Open
Conversation
The repository has no dependency automation, so drift is only caught when someone notices -- the deleted capacitor-swift-pm branch behind capacitor-community#697 and the 13 npm advisories cleared in capacitor-community#698 are both instances of that. Configure Dependabot for the four ecosystems it can see: npm (root), gradle (/android), swift (Package.swift) and github-actions. CocoaPods has no Dependabot ecosystem, so CapacitorCommunitySqlite.podspec still needs manual bumps; noted in a comment. Tuned for low maintenance rather than maximum freshness: - Weekly schedule, Monday 06:00 UTC, capped at 5 open PRs per ecosystem. - Grouped so a normal week is a handful of PRs: @capacitor/* together (they release in lockstep and CI validates them together), dev dependencies together, production dependencies together, all actions/* together. Majors outside the Capacitor group stay ungrouped so they get their own review. - A cooldown of 7 days (14 for majors, 3 for patches) so releases that get pulled or hotfixed within days never reach a PR. None of this throttles security updates: those are a separate Dependabot feature that ignores schedule, cooldown and open-pull-requests-limit, so advisories still open a PR as soon as a fix ships. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a
.github/dependabot.yml. Independent of #698 — no shared commits, branched straight offmaster, so the two can be reviewed and merged in either order.Why
The repo has no dependency automation, so drift only surfaces when someone trips over it. Two recent examples: the deleted
capacitor-swift-pmbranch behind #697, and the 13 npm advisories cleared in #698 (1 critical, 6 high).What is covered
npm/package.json,package-lock.jsongradle/androidandroid/build.gradleswift/Package.swiftgithub-actions/.github/workflows/*CocoaPods has no Dependabot ecosystem, so
CapacitorCommunitySqlite.podspecstill needs manual bumps. Called out in a comment in the file so it is not mistaken for an oversight.Package.resolvedis gitignored here, so the Swift updater bumps the declared version requirements only — which is exactly the class of drift that produced #697.Tuning
Aimed at staying maintainable, not at maximum freshness:
@capacitor/*in one PR (they release in lockstep and CI validates them together), dev dependencies in one, production dependencies in one, allactions/*in one. Majors outside the Capacitor group stay ungrouped so each gets its own review.chore(deps):/chore(deps-dev):, andci(deps):for actions, socommit-and-tag-versionkeeps producing sensible changelogs.Security updates are deliberately not throttled. They are a separate Dependabot feature that ignores
schedule,cooldownandopen-pull-requests-limit, so advisories still open a PR as soon as a fix is published.Note on activation
The config only takes effect once it is on the default branch of this repo and Dependabot is enabled in repository settings. Nothing happens from the fork side.
Verification
Config parses as valid YAML and every key is checked against the current Dependabot options reference. Behavior itself can only be confirmed after merge — the first scheduled run, or a manual "Check for updates" from the Insights → Dependency graph → Dependabot tab.
🤖 Generated with Claude Code