From 7af7a89def5d17442411c2cb00f93f690aed5924 Mon Sep 17 00:00:00 2001 From: Giulia Stocco <98900+gfs@users.noreply.github.com> Date: Fri, 31 Jul 2026 07:42:46 -0700 Subject: [PATCH] Add Dependabot config that consolidates updates into a single PR Group npm, NuGet, and GitHub Actions version updates into one weekly multi-ecosystem pull request, and collapse security updates into one grouped pull request per ecosystem, so dependency maintenance no longer requires reviewing and merging a PR per dependency. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/copilot-instructions.md | 15 ++++- .github/dependabot.yml | 100 ++++++++++++++++++++++++++++++++ Changelog.md | 7 +++ 3 files changed, 119 insertions(+), 3 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index 2c2a10a4..56870472 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -32,16 +32,23 @@ DevSkim is a framework of IDE extensions and language analyzers that provide inl - This project uses **squash merges** - PR gate checks verify `Changelog.md` is updated - Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) -- Use semantic versioning: `[MAJOR.MINOR.PATCH]` +- Version headings are `[MAJOR.MINOR.PATCH]` and must match the version the build actually produces + +**Versioning**: this repo versions with [Nerdbank.GitVersioning](https://github.com/dotnet/Nerdbank.GitVersioning). `version.json` pins `MAJOR.MINOR` (currently `1.0`) and the patch number is the **git height**, which is the commit count since `version.json` last changed. Do **not** guess it by incrementing the previous changelog entry: an open PR's height shifts every time another PR merges ahead of it, and blindly incrementing bakes that drift in permanently. **When making changes**: 1. Add a new entry at the top of `Changelog.md` (after the header) -2. Use the **next patch version** (increment last number by 1) +2. Determine the version by asking Nerdbank.GitVersioning what this commit produces, rather than incrementing the previous entry: + ```bash + dotnet tool install --global nbgv # once + nbgv get-version -v SimpleVersion # e.g. 1.0.95 + ``` + Run this **after** committing your change and with your branch rebased on the latest `main`, since the height includes your own commit. If your PR sits open while other PRs merge, re-run it and update the heading before merging. 3. Use today's date in YYYY-MM-DD format 4. Group changes by type: `### Fix`, `### Added`, `### Changed`, `### Dependencies`, `### Pipeline`, etc. 5. Write clear, actionable descriptions -**Example**: +**Example** (assuming `nbgv get-version -v SimpleVersion` reported `1.0.72`): ```markdown ## [1.0.72] - 2026-02-04 ### Added @@ -51,6 +58,8 @@ DevSkim is a framework of IDE extensions and language analyzers that provide inl - Updated build documentation ``` +**Exception**: the gate ([`tarides/changelog-check-action`](https://github.com/tarides/changelog-check-action)) is skipped on PRs carrying the `no changelog` label. That is reserved for changes that are not user-visible, and Dependabot applies it automatically via `.github/dependabot.yml`. Do not use it to avoid writing an entry for a real change. + ## Building and Testing ### VS Code Plugin (TypeScript) diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..2c01508c --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,100 @@ +# Dependabot configuration for DevSkim. +# +# Goal: one pull request to review and merge instead of one per dependency. +# +# * Version updates for every ecosystem (npm, NuGet, GitHub Actions) are assigned to +# the `all-dependencies` multi-ecosystem group, so Dependabot consolidates them -- +# across every directory it monitors -- into a single weekly pull request. +# * Security updates cannot join a multi-ecosystem group, so each ecosystem also +# declares a `*-security-updates` group. Advisory-driven bumps then arrive as one +# grouped pull request per ecosystem instead of one per advisory. +# * `open-pull-requests-limit: 1` caps each ecosystem at a single open version-update +# pull request, so nothing slips out of the grouping. +# * The `no changelog` label lets the required "Check Changelog Action" gate pass on +# bot pull requests, which do not touch Changelog.md. +# +# Reference: +# https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference + +version: 2 + +multi-ecosystem-groups: + all-dependencies: + schedule: + interval: "weekly" + day: "monday" + time: "06:00" + timezone: "Etc/UTC" + labels: + - "dependencies" + - "no changelog" + +updates: + # VS Code plugin: extension host and language client packages. + - package-ecosystem: "npm" + directories: + - "/DevSkim-VSCode-Plugin" + - "/DevSkim-VSCode-Plugin/client" + schedule: + interval: "weekly" + day: "monday" + time: "06:00" + timezone: "Etc/UTC" + multi-ecosystem-group: "all-dependencies" + patterns: + - "*" + open-pull-requests-limit: 1 + labels: + - "dependencies" + - "no changelog" + - "javascript" + groups: + npm-security-updates: + applies-to: security-updates + patterns: + - "*" + + # .NET: library, CLI, language server, and Visual Studio extension projects + # discovered through Microsoft.DevSkim.sln. + - package-ecosystem: "nuget" + directory: "/DevSkim-DotNet" + schedule: + interval: "weekly" + day: "monday" + time: "06:00" + timezone: "Etc/UTC" + multi-ecosystem-group: "all-dependencies" + patterns: + - "*" + open-pull-requests-limit: 1 + labels: + - "dependencies" + - "no changelog" + - ".NET" + groups: + nuget-security-updates: + applies-to: security-updates + patterns: + - "*" + + # GitHub Actions used by the workflows in .github/workflows. + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + time: "06:00" + timezone: "Etc/UTC" + multi-ecosystem-group: "all-dependencies" + patterns: + - "*" + open-pull-requests-limit: 1 + labels: + - "dependencies" + - "no changelog" + - "pipeline" + groups: + github-actions-security-updates: + applies-to: security-updates + patterns: + - "*" diff --git a/Changelog.md b/Changelog.md index 23b7cc42..0971c687 100644 --- a/Changelog.md +++ b/Changelog.md @@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [1.0.95] - 2026-07-31 +### Pipeline +- Added `.github/dependabot.yml` so Dependabot consolidates npm, NuGet, and GitHub Actions version updates into a single weekly pull request via a multi-ecosystem group, groups security updates per ecosystem into one pull request each, and labels its pull requests `no changelog` so the changelog gate passes. + +### Documentation +- Corrected the changelog guidance in `.github/copilot-instructions.md` to derive the version heading from Nerdbank.GitVersioning (`nbgv get-version`) instead of incrementing the previous entry, which had let the changelog headings drift behind the versions actually built, and documented the `no changelog` label as the gate's escape hatch. + ## [1.0.87] - 2026-07-15 ### Pipeline - Updated the CLI release pipeline to use the .NET 10 SDK when restoring, building, packaging, and releasing .NET 10 targets.