From 9e99807b0d8be4cc8b94a44bd755de7e458cdf85 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" Date: Thu, 15 Oct 2026 02:04:21 +0100 Subject: [PATCH] chore(dependabot): configure version updates for bun and github-actions There was no dependabot.yml, so Dependabot never created version updates; only security updates ran, and those (2026-09-26..27) failed because the npm_and_yarn updater refuses a Bun-managed project while trying to fix alerts against the since-removed test/doi fixtures. Both alerts are now fixed and the fixtures gone. Version updates, weekly, grouped, conventional-commit prefixed: - "bun" for /frontend, the ecosystem Dependabot requires for bun.lock (the npm_and_yarn updater cannot update it). - "github-actions" for the workflow pins, which advances the full-SHA pins while keeping the account's allowlist policy intact. Julia (Project.toml/Manifest.toml) and R (renv.lock) are not Dependabot ecosystems; their pins stay in config/defaults/tool_versions.yml, asserted by test/unit/test_install_pins.jl. Generated by Mistral Vibe. Co-Authored-By: Mistral Vibe --- .github/dependabot.yml | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..1454ca3b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,39 @@ +# Dependabot version updates. Until this file landed, only security updates +# ran (those need no configuration), and those failed for a separate reason: +# the "Dependabot Updates" runs of 2026-09-26..27 tried to fix alerts against +# fixtures under test/doi using the npm_and_yarn updater, which refuses a +# Bun-managed project ("bun.lock but no package-lock.json"). Those fixtures +# have since left the repository and both alerts are fixed. +# +# What cannot be covered here: Julia (Project.toml / Manifest.toml) and R +# (renv.lock) are not Dependabot package-ecosystems. Their pins live in +# config/defaults/tool_versions.yml and are asserted by +# test/unit/test_install_pins.jl and the CI workflow instead. +# +# The workflows pin every action to a full commit SHA (this account's +# allowlist policy, asserted by test/unit/test_install_pins.jl). Dependabot +# advances those pins to the current SHA of the tracked version, so the +# pinning policy itself survives updates. +version: 2 +updates: + # The frontend is Bun-managed: package.json plus bun.lock, no npm/yarn/pnpm + # lockfile, so it must be declared as the "bun" ecosystem. + - package-ecosystem: "bun" + directory: "/frontend" + schedule: + interval: "weekly" + commit-message: + prefix: "chore(deps)" + groups: + frontend: + patterns: ["*"] + + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + commit-message: + prefix: "chore(deps)" + groups: + actions: + patterns: ["*"]