From aa673ddcbc82639a5eb9d198f9d939bfcc1d98f0 Mon Sep 17 00:00:00 2001 From: Robert Betts Date: Tue, 1 Sep 2026 10:04:05 +0100 Subject: [PATCH 1/2] Point Dependabot at development instead of main. Dependabot only reads this file on the default branch, so land target-branch here; PRs still merge via development. Co-authored-by: Cursor --- .github/dependabot.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5ccddc2..6a8d9a7 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,6 +5,8 @@ updates: schedule: interval: monthly open-pull-requests-limit: 5 + # Prefer feature → development → main; Dependabot otherwise targets default (main). + target-branch: development ignore: # bincode 3.0.0 is an intentional unmaintained stub that only fails to compile. - dependency-name: bincode @@ -16,11 +18,15 @@ updates: - "tonic-*" - "prost" - "prost-*" + sp1: + patterns: + - "sp1-*" - package-ecosystem: cargo directory: /clients/rust schedule: interval: monthly open-pull-requests-limit: 3 + target-branch: development groups: tonic-prost: patterns: @@ -32,3 +38,4 @@ updates: directory: / schedule: interval: monthly + target-branch: development From 086514b1bea9efffa1c5b6908a73add231d4867c Mon Sep 17 00:00:00 2001 From: Robert Betts Date: Tue, 1 Sep 2026 10:04:22 +0100 Subject: [PATCH 2/2] =?UTF-8?q?Document=20feature=20=E2=86=92=20developmen?= =?UTF-8?q?t=20=E2=86=92=20main=20and=20Dependabot=20targeting.?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Cursor --- CONTRIBUTING.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 53410c9..382c5be 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -72,12 +72,16 @@ Do not run real CPU `SP1_PROVER=cpu --prove-one` on ≤16 GiB machines without ## Pull requests -1. Branch from `main` (or the active integration branch agreed with maintainers). +Flow: **feature → `development` → `main`**. Open product PRs against `development`, not `main`. + +1. Branch from `development`. 2. Ensure mock CI paths pass locally when touching receipts, guests, or gRPC. 3. If you change the Lean SP1 guest or runtime patches, run `bash scripts/sp1_execute_ci.sh` locally (and refresh `artifacts/sp1_guest_digests.json` from Linux if digests change). Automatic `sp1-execute` CI is off for now — GH runners lack the compute. 4. Describe **why** in the PR body; link issues if any. 5. Do not commit secrets, `.env` files, `host/target/`, `.cache/`, or editor junk (e.g. `.#`). +Dependabot PRs target **`development`** (see [`.github/dependabot.yml`](.github/dependabot.yml)). That `target-branch` must stay on the default branch (`main`) or GitHub ignores it. + ## Reporting issues Use GitHub Issues for bugs and feature requests. For security-sensitive reports, see [SECURITY.md](SECURITY.md).