chore(ci): Add Dependabot config for GitHub Actions - #37
Merged
Conversation
Keeps the action majors pinned across the ci, live, and release workflows current instead of drifting until a runner deprecation breaks them. All bumps are grouped into one weekly PR, so a week that ships checkout, setup-go, and golangci-lint-action costs a single review and a single CI run rather than three. The commit prefix is set to `ci` to match the repo's Conventional Commits format. The `gomod` ecosystem is deliberately omitted. AGENTS.md mandates standard library only, so go.mod carries zero requires and there is no go.sum; Dependabot's Go updater would have nothing to bump, as it does not touch the `go` directive. Whether to auto-bump requires at all is a decision better made alongside the first real dependency: this module is imported as a library, and under minimal version selection a require is a floor, so raising it raises the floor for every consumer. Dependabot security updates are not configured here. They are a repository setting, run off the dependency graph, and need no entry in this file; they have been enabled separately and will cover a future dependency without further changes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017dM7M83LicKy8psVSvjod2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Nothing watches the action versions pinned in our workflows, so they drift until a deprecation breaks the build.
ci.yml,live.yml, andrelease.ymlpin three actions by major tag —actions/checkout@v4,actions/setup-go@v5,golangci/golangci-lint-action@v7. A major tag absorbs patches, but never the next major, and GitHub retires runner-side support on its own schedule. The usual failure mode is a red build on an unrelated PR, with the fix owed by whoever happened to push that day.No visual change — this is CI configuration only.
Solution
Add a Dependabot config that bumps GitHub Actions weekly, grouped into a single PR.
Grouping is the load-bearing choice: a week that ships new majors of checkout, setup-go, and golangci-lint-action produces one PR and one CI run instead of three. The
cicommit prefix keeps the generated commits inside our Conventional Commits format.Dependency maintenance here has two independent levers, and only one of them is a file:
.github/dependabot.yml(this diff)github-actionsWhy no
gomodentryA reviewer will reasonably ask. AGENTS.md mandates standard library only, so
go.modcarries zero requires and there is nogo.sum— Dependabot's Go updater would have nothing to bump, since it does not touch thegodirective.The entry is also not obvious future-proofing. This module is imported as a library, and under minimal version selection a
requireis a floor rather than a pin: auto-bumping it would raise the minimum for every consumer, which is often the wrong default for a library. That trade-off can't be settled before we know what the first dependency is, so the decision belongs in the PR that adds it — a PR that must already touchgo.modand amend the standard-library-only rule in AGENTS.md, making it a reliable place to remember.Other Changes
Dependabot security updates were enabled on the repository (with the vulnerability alerts they depend on) outside this diff, since they are a repo setting rather than config. They run off the dependency graph and need no entry in
dependabot.yml, so they will cover a future dependency with no further change here. Both are inert today.🤖 Generated with Claude Code