a6462876deEvery groups entry has an implicit applies-to: version-updates, which means security advisories bypass the group config and open one PR per affected package. The 11-PR backlog this week was driven by exactly this: four /studio/src-tauri cargo advisories (rustls-webpki, tauri, rand, openssl) opened individually instead of joining the cargo-tauri group PR, and one /studio/frontend npm group PR (hono + ip-address) opened outside the bun config because GitHub fires npm-package advisories under the npm_and_yarn ecosystem regardless of which package manager actually owns the lockfile. Two changes: 1. Sibling groups with applies-to: security-updates for each existing ecosystem (actions, bun, npm-oxc-validator, python, cargo-tauri). Same patterns: ["*"] coverage, so security advisories batch into a single PR per ecosystem per week alongside the version-update group. 2. New npm entry pointed at /studio/frontend with open-pull-requests-limit: 0 (suppress version-update PRs; bun handles those) but with a security-updates group so future hono-style advisories land in one batched PR instead of one PR per package. Doesn't retroactively regroup PRs already open; the existing 11 are unaffected and merge as-is.
75 lines
1.9 KiB
YAML
75 lines
1.9 KiB
YAML
---
|
|
version: 2
|
|
updates:
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
groups:
|
|
actions:
|
|
patterns: ["*"]
|
|
actions-security:
|
|
applies-to: security-updates
|
|
patterns: ["*"]
|
|
|
|
- package-ecosystem: "bun"
|
|
directory: "/studio/frontend"
|
|
schedule:
|
|
interval: "weekly"
|
|
groups:
|
|
bun-frontend:
|
|
patterns: ["*"]
|
|
bun-frontend-security:
|
|
applies-to: security-updates
|
|
patterns: ["*"]
|
|
|
|
- package-ecosystem: "npm"
|
|
directory: "/studio/backend/core/data_recipe/oxc-validator"
|
|
schedule:
|
|
interval: "weekly"
|
|
groups:
|
|
npm-oxc-validator:
|
|
patterns: ["*"]
|
|
npm-oxc-validator-security:
|
|
applies-to: security-updates
|
|
patterns: ["*"]
|
|
|
|
# pip + cargo grouped weekly; the *-security siblings batch
|
|
# advisories that would otherwise each open their own PR.
|
|
- package-ecosystem: "pip"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
python:
|
|
patterns: ["*"]
|
|
python-security:
|
|
applies-to: security-updates
|
|
patterns: ["*"]
|
|
|
|
- package-ecosystem: "cargo"
|
|
directory: "/studio/src-tauri"
|
|
schedule:
|
|
interval: "weekly"
|
|
groups:
|
|
cargo-tauri:
|
|
patterns: ["*"]
|
|
cargo-tauri-security:
|
|
applies-to: security-updates
|
|
patterns: ["*"]
|
|
|
|
# bun owns version updates for /studio/frontend (above); GitHub
|
|
# fires npm-package advisories under npm_and_yarn, so this entry
|
|
# catches and groups them. limit: 0 suppresses version-update
|
|
# PRs, security updates flow through regardless.
|
|
- package-ecosystem: "npm"
|
|
directory: "/studio/frontend"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 0
|
|
groups:
|
|
npm-frontend-security:
|
|
applies-to: security-updates
|
|
patterns: ["*"]
|
|
...
|