Skip to content

ci: limit dependabot majors, fix deploy doc drift #389

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
FlyM1ss merged 2 commits into from
Jul 31, 2026
Merged

ci: limit dependabot majors, fix deploy doc drift #389

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c23e838
ci: limit dependabot to non-major updates
FlyM1ss Jul 31, 2026
fc29767
docs(deploy): correct workflow description after #364
FlyM1ss Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
63 changes: 57 additions & 6 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,28 @@
# image build + pytest, so a bump that breaks resolution or the image fails the PR
# rather than the production deploy.
#
# Grouping policy: minor+patch collapse into one PR per ecosystem per run (that is the
# bulk of the volume and it is rarely worth reviewing separately); majors stay
# ungrouped so each lands on its own reviewable diff. Security updates ignore grouping
# config and keep arriving individually, which is what we want.
# Update policy: minor+patch collapse into one PR per ecosystem per run (that is the
# bulk of the volume and it is rarely worth reviewing separately). MAJORS ARE IGNORED
# and must be raised deliberately, one at a time, by someone who has read the upstream
# changelog.
#
# That last rule is not caution for its own sake. When this file first landed it opened
# 21 PRs in a single run (#365-#385) -- the whole accumulated backlog of a repo that had
# never had scheduled version updates -- and the majors in that batch included
# actions/checkout 4->7, @babel/core 7->8, gunicorn 25->26 and appleboy/ssh-action
# 0.1->1.2. Ten of them showed green checks, which is the dangerous part: green here
# means "resolves and builds", not "safe to ship". The deploy job is skipped on PRs, so
# a bump to the deploy action itself is never exercised pre-merge, and merging any
# Main/backend/** change pushes to the droplet. The eight frontend/docs PRs had no CI at
# all (no lockfile -- see #386 -- and no frontend suite), so they looked identical to a
# validated one.
#
# This costs nothing on the security side. `ignore` and `open-pull-requests-limit` are
# VERSION-update options only: security updates are exempt from both and keep arriving
# individually, majors included. Grouping does not apply to them either.
#
# To take a major deliberately: `@dependabot reopen` on the closed PR, or drop the
# ignore entry for that one dependency and let the next run raise it.
version: 2
updates:
# ---- Python: backend (uv) --------------------------------------------------------
Expand All @@ -28,9 +46,13 @@ updates:
directory: "/Main/backend"
schedule:
interval: "monthly"
open-pull-requests-limit: 5
open-pull-requests-limit: 3
commit-message:
prefix: "build(deps)"
ignore:
- dependency-name: "*"
update-types:
- "version-update:semver-major"
groups:
backend-minor-patch:
update-types:
Expand All @@ -46,9 +68,16 @@ updates:
directory: "/Main/frontend"
schedule:
interval: "monthly"
open-pull-requests-limit: 5
open-pull-requests-limit: 3
commit-message:
prefix: "build(deps)"
# Majors matter most here of all six: with no lockfile and no frontend CI, an npm
# bump is reviewed by reading the diff and nothing else. #379/#380 (@babel 7->8)
# would have merged on a bare NEUTRAL check.
ignore:
- dependency-name: "*"
update-types:
- "version-update:semver-major"
groups:
frontend-minor-patch:
update-types:
Expand All @@ -63,6 +92,10 @@ updates:
open-pull-requests-limit: 3
commit-message:
prefix: "build(deps)"
ignore:
- dependency-name: "*"
update-types:
- "version-update:semver-major"
groups:
concierge-minor-patch:
update-types:
Expand All @@ -79,6 +112,10 @@ updates:
open-pull-requests-limit: 3
commit-message:
prefix: "build(deps)"
ignore:
- dependency-name: "*"
update-types:
- "version-update:semver-major"
groups:
docs-minor-patch:
update-types:
Expand All @@ -104,6 +141,16 @@ updates:
open-pull-requests-limit: 3
commit-message:
prefix: "build(deps)"
# The major-ignore below does NOT protect the coupling described above: the base
# image moves in the v1.MINOR.0-jammy line, so a playwright bump arrives as a MINOR
# and is raised normally. #365 (v1.58.0 -> v1.61.0) is the worked example -- it
# failed CI, correctly, because the pyproject pin had not moved with it. Expect that
# class of PR to keep coming and to need manual pairing; the red check is the
# reminder, not a bug.
ignore:
- dependency-name: "*"
update-types:
- "version-update:semver-major"

# ---- GitHub Actions --------------------------------------------------------------
# Every `uses:` in this repo is SHA-pinned with a trailing `# vX.Y.Z` comment
Expand All @@ -117,6 +164,10 @@ updates:
open-pull-requests-limit: 3
commit-message:
prefix: "build(deps)"
ignore:
- dependency-name: "*"
update-types:
- "version-update:semver-major"
groups:
actions-minor-patch:
update-types:
Expand Down
8 changes: 4 additions & 4 deletions Deploy/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
# Deployment Automation

The `Backend CI and Deploy` workflow (`.github/workflows/backend-deploy.yml`) turns pushes to `main` into a tested container image plus an optional restart of the Fedora droplet (`fedora-agentic-finsearch-beta-1`). The flow:
The `Backend CI and Deploy` workflow (`.github/workflows/backend-deploy.yml`) runs on pull requests and on pushes to `main`, both filtered to the same paths (`Main/backend/**` and the workflow file itself). A pull request run **validates only**; a push to `main` validates, publishes the image, and optionally restarts the Fedora droplet (`fedora-agentic-finsearch-beta-1`). The flow:

1. Checks out this repo and installs Python `3.12` with `uv`.
2. Runs `uv sync --frozen`, `uv run python manage.py check`, and `uv run python manage.py test` inside `Main/backend`.
3. Builds the backend container with the Dockerfile in `Main/backend/` and pushes three tags to GHCR:
2. Runs `uv sync --locked`, `uv run python manage.py check`, and `uv run python manage.py test` inside `Main/backend`. `--locked` rather than `--frozen`: it fails if `uv.lock` has drifted from `pyproject.toml`, instead of quietly building from stale resolutions. `Main/backend/Dockerfile` still uses `--frozen`, correctly — by the time it runs, this step has already validated the very lock it copies in.
3. Builds the backend container with the Dockerfile in `Main/backend/`. On pushes to `main` and on `workflow_dispatch` it then pushes three tags to GHCR — **pull request runs stop after the build and publish nothing**:
- `ghcr.io/<owner>/<repo>-backend:${GITHUB_SHA}`
- `ghcr.io/<owner>/<repo>-backend:main`
- `ghcr.io/<owner>/<repo>-backend:latest`
4. Uses SSH to reach `deploy@agenticfinsearch.org`, pulls the `:main` tag with `podman`, and restarts the user-level systemd unit `fingpt-api`.
4. Uses SSH to reach `deploy@agenticfinsearch.org`, pulls the `:main` tag with `podman`, and restarts the user-level systemd unit `fingpt-api`. This job is ref-gated to `main`, so it never runs for a pull request.

## Required GitHub secrets

Expand Down