Repository navigation
Add the org Dependabot control plane - #5
Merged
Merged
Conversation
One Dependabot standard for every Simtabi-owned org, kept in sync and merged by policy from here: - dependabot/policy.json: the standard (schedule, groups, cooldown, PR limit, labels, prefixes, merge policy) and the owned-org list. - reconcile.py + dependabot-reconcile.yml (weekly, after Dependabot's run): renders each active repo's dependabot.yml with agent-kit's generator and opens one PR where it drifts. Refresh Bot token per org; never pushes to a default branch. New repos are picked up on the next run. - merge.py + dependabot-merge.yml (hourly): merges a Dependabot PR only when policy allows its update type (default: GitHub Actions only; majors never) and every check and status on its exact head SHA is green, at least as many as on the repo's last merged PR. Uses the Dependency Merge Bot, whose key is a secret on this repository only. Squash, pinned to the head SHA. Both are dry runs until DEPENDABOT_RECONCILE_APPLY / DEPENDABOT_MERGE_APPLY are set. ci.yml runs the 13 unit tests (30 decide() cases) and actionlint.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One Dependabot standard for every Simtabi-owned org, kept in sync and
merged by policy from here:
limit, labels, prefixes, merge policy) and the owned-org list.
renders each active repo's dependabot.yml with agent-kit's generator and
opens one PR where it drifts. Refresh Bot token per org; never pushes to a
default branch. New repos are picked up on the next run.
policy allows its update type (default: GitHub Actions only; majors never)
and every check and status on its exact head SHA is green, at least as many
as on the repo's last merged PR. Uses the Dependency Merge Bot, whose key
is a secret on this repository only. Squash, pinned to the head SHA.
Both are dry runs until DEPENDABOT_RECONCILE_APPLY / DEPENDABOT_MERGE_APPLY
are set. ci.yml runs the 13 unit tests (30 decide() cases) and actionlint.