From 0c5228076876167dfb597e559b31d3d4ed3a1001 Mon Sep 17 00:00:00 2001 From: Yasunori MATSUOKA Date: Mon, 24 Aug 2026 22:52:27 +0900 Subject: [PATCH] ci(dependabot): cover the standalone apps/* installs with npm version updates The npm configuration only watched the root workspace lockfile, so the twelve standalone installs under apps/ -- each owning its package.json and lockfile -- received no version updates at all. The bumps that did land there came from Dependabot's security updates, which scan every manifest regardless of this file. Add one npm entry per directory that owns a lockfile, matching the conventions of the existing entries: weekly schedule, a 7-day release cooldown, and minor + patch bundled into a single grouped pull request so majors stay separate. Each group is named after its directory, so a pull request title says which app it belongs to. One entry per directory rather than a single entry listing them under `directories:`: combined with `groups:`, that form can bundle unrelated apps into one pull request, and such a pull request goes stale the moment any one of those directories moves -- #76 is an open example, superseded by #79. Carry over the held majors from the per-app Dependabot configs of the source repositories (apps//.github/dependabot.yml, inert since GitHub reads only the root file): React 18 and the Tailwind 3 / daisyUI 2 pair in hackathon, TypeScript 5 and symbol-sdk 2 in its functions, firebase-admin 13 in flea-market's functions (firebase-functions 7 peers on ^11 || ^12 || ^13), and ESLint 10 in xymposium-lp-2024, whose bundled eslint-plugin-react still calls the removed context.getFilename(). Each hold was re-checked against the current manifest; hackathon's ESLint hold is deliberately not carried over, as that app is already on ESLint 10. apps/flea-market/worker and packages/* stay absent: they have no lockfile of their own and are already updated through the root workspace entry. The per-app limit is 5 rather than the root entry's 10 to cap how much lands for review on any one weekly run. --- .github/dependabot.yml | 255 ++++++++++++++++++++++++++++++++++++++++- 1 file changed, 252 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 7fccee15..a075b0f6 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -21,10 +21,10 @@ updates: - patch # ---------------------------------------------------------------------------- - # npm — the ROOT WORKSPACE lockfile only (packages/* + apps/*/worker). + # npm — the ROOT WORKSPACE lockfile (packages/* + apps/*/worker). # The apps/* frontends install standalone with their own lockfiles (React 18 - # vs 19 isolation — see root package.json) and are deliberately NOT enumerated - # here to keep PR noise proportionate; add per-app entries later if wanted. + # vs 19 isolation — see root package.json), so each of them gets its own entry + # below; this entry covers the root lockfile alone. # ---------------------------------------------------------------------------- - package-ecosystem: npm directory: "/" @@ -43,3 +43,252 @@ updates: # @types/node tracks the Node runtime major; hold the major. - dependency-name: "@types/node" update-types: ["version-update:semver-major"] + + # ---------------------------------------------------------------------------- + # npm — the standalone apps/* installs, one entry per lockfile. + # Every app owns its package.json + lockfile and is built from inside its own + # directory, so each needs a separate entry: a single entry listing them under + # `directories:` would bundle unrelated apps into one pull request, and such a + # pull request goes stale as soon as any one of those directories moves (#76, + # superseded by #79, is an open example). + # `apps/flea-market/worker` and `packages/*` are absent on purpose — they have + # no lockfile of their own and are updated through the root workspace entry. + # The limit is lower than the root entry's because these twelve entries fire + # on the same weekly schedule; it caps how much lands for review at once, and + # each entry's limit is independent of every other's. + # The `ignore` entries are held majors carried over from the per-app configs + # of the repositories these apps came from (apps//.github/dependabot.yml, + # inert here because GitHub reads only this file). Those copies are superseded + # by this one — each hold below was re-checked against the current manifest. + # ---------------------------------------------------------------------------- + + - package-ecosystem: npm + directory: "/apps/flea-market" + schedule: + interval: weekly + open-pull-requests-limit: 5 + cooldown: + default-days: 7 + groups: + flea-market-minor-patch: + applies-to: version-updates + update-types: + - minor + - patch + ignore: + # @types/node tracks the Node runtime major; hold the major. + - dependency-name: "@types/node" + update-types: ["version-update:semver-major"] + + # Cloud Functions package; its runtime major is pinned by engines.node. + - package-ecosystem: npm + directory: "/apps/flea-market/functions" + schedule: + interval: weekly + open-pull-requests-limit: 5 + cooldown: + default-days: 7 + groups: + flea-market-functions-minor-patch: + applies-to: version-updates + update-types: + - minor + - patch + ignore: + # firebase-functions 7 rejects firebase-admin 14: its peer range is + # ^11.10.0 || ^12.0.0 || ^13.0.0. Revisit when that range widens. + - dependency-name: "firebase-admin" + update-types: ["version-update:semver-major"] + # @types/node tracks the Node runtime major; hold the major. + - dependency-name: "@types/node" + update-types: ["version-update:semver-major"] + + - package-ecosystem: npm + directory: "/apps/hackathon" + schedule: + interval: weekly + open-pull-requests-limit: 5 + cooldown: + default-days: 7 + groups: + hackathon-minor-patch: + applies-to: version-updates + update-types: + - minor + - patch + ignore: + # React 19 is deferred until this app's migration is scoped; it is what + # keeps this app installing separately from flea-market. + - dependency-name: "react" + update-types: ["version-update:semver-major"] + - dependency-name: "react-dom" + update-types: ["version-update:semver-major"] + - dependency-name: "@types/react" + update-types: ["version-update:semver-major"] + - dependency-name: "@types/react-dom" + update-types: ["version-update:semver-major"] + # TypeScript 6 is not supported by this app's toolchain yet. + - dependency-name: "typescript" + update-types: ["version-update:semver-major"] + # daisyUI 5 requires Tailwind 4; the two move together. + - dependency-name: "daisyui" + update-types: ["version-update:semver-major"] + - dependency-name: "tailwindcss" + update-types: ["version-update:semver-major"] + # @types/node tracks the Node runtime major; hold the major. + - dependency-name: "@types/node" + update-types: ["version-update:semver-major"] + + # Cloud Functions package; its runtime major is pinned by engines.node. + - package-ecosystem: npm + directory: "/apps/hackathon/functions" + schedule: + interval: weekly + open-pull-requests-limit: 5 + cooldown: + default-days: 7 + groups: + hackathon-functions-minor-patch: + applies-to: version-updates + update-types: + - minor + - patch + ignore: + # TypeScript 6 / ESLint 10 are not supported by this toolchain yet. + - dependency-name: "typescript" + update-types: ["version-update:semver-major"] + - dependency-name: "eslint" + update-types: ["version-update:semver-major"] + # symbol-sdk 3 is a crypto-breaking rewrite; migrate it deliberately. + - dependency-name: "symbol-sdk" + update-types: ["version-update:semver-major"] + # @types/node tracks the Node runtime major; hold the major. + - dependency-name: "@types/node" + update-types: ["version-update:semver-major"] + + - package-ecosystem: npm + directory: "/apps/hackathon-lp" + schedule: + interval: weekly + open-pull-requests-limit: 5 + cooldown: + default-days: 7 + groups: + hackathon-lp-minor-patch: + applies-to: version-updates + update-types: + - minor + - patch + + - package-ecosystem: npm + directory: "/apps/hackathon-lp-2023" + schedule: + interval: weekly + open-pull-requests-limit: 5 + cooldown: + default-days: 7 + groups: + hackathon-lp-2023-minor-patch: + applies-to: version-updates + update-types: + - minor + - patch + + - package-ecosystem: npm + directory: "/apps/hackathon-lp-2024" + schedule: + interval: weekly + open-pull-requests-limit: 5 + cooldown: + default-days: 7 + groups: + hackathon-lp-2024-minor-patch: + applies-to: version-updates + update-types: + - minor + - patch + + - package-ecosystem: npm + directory: "/apps/hackathon-lp-2025" + schedule: + interval: weekly + open-pull-requests-limit: 5 + cooldown: + default-days: 7 + groups: + hackathon-lp-2025-minor-patch: + applies-to: version-updates + update-types: + - minor + - patch + + # Installs with pnpm; the npm ecosystem is what reads pnpm-lock.yaml. + - package-ecosystem: npm + directory: "/apps/hackathon-lp-2026" + schedule: + interval: weekly + open-pull-requests-limit: 5 + cooldown: + default-days: 7 + groups: + hackathon-lp-2026-minor-patch: + applies-to: version-updates + update-types: + - minor + - patch + ignore: + # @types/node tracks the Node runtime major; hold the major. + - dependency-name: "@types/node" + update-types: ["version-update:semver-major"] + + - package-ecosystem: npm + directory: "/apps/xymposium-lp" + schedule: + interval: weekly + open-pull-requests-limit: 5 + cooldown: + default-days: 7 + groups: + xymposium-lp-minor-patch: + applies-to: version-updates + update-types: + - minor + - patch + + - package-ecosystem: npm + directory: "/apps/xymposium-lp-2024" + schedule: + interval: weekly + open-pull-requests-limit: 5 + cooldown: + default-days: 7 + groups: + xymposium-lp-2024-minor-patch: + applies-to: version-updates + update-types: + - minor + - patch + ignore: + # ESLint 10 removed context.getFilename(), which the eslint-plugin-react + # bundled with eslint-config-next still calls. Drop this once the bundled + # plugin is fixed upstream. + - dependency-name: "eslint" + versions: [">=10"] + # @types/node tracks the Node runtime major; hold the major. + - dependency-name: "@types/node" + update-types: ["version-update:semver-major"] + + # No dependencies yet; the entry tracks the lockfile so additions are covered. + - package-ecosystem: npm + directory: "/apps/xymposium-lp-2025" + schedule: + interval: weekly + open-pull-requests-limit: 5 + cooldown: + default-days: 7 + groups: + xymposium-lp-2025-minor-patch: + applies-to: version-updates + update-types: + - minor + - patch