chore(dependabot): Tier 1 policy — daily 05:00 UTC, cooldown 7, no majors - #24
Merged
Merged
Conversation
…jors This repo is Tier 1: production ships when the floating vMAJOR tag moves by hand, not when a PR merges. Consumers pin @v14 and never read main, so main is effectively staging and auto-merging patch+minor onto it is safe for the same reason it is safe in donation-form. It sat in Tier 2 in earlier drafts, which was wrong — Tier 2's defining claim is that the merge IS the deploy, and here it deploys nothing. Adds the two org constants this config was missing entirely: a 7-day cooldown and an ignore for all major version updates. Note ignore covers version updates only; a security major can still open a PR, and the auto-merge workflow's update-type gate is what refuses to merge it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Applies the agreed org policy to this repo's own Dependabot config, which had neither constant: no cooldown, no major-ignore.
Tier 1, not Tier 2
This repo sat in Tier 2 in earlier drafts and that was wrong. Tier 2's defining claim is that the merge is the deploy. Here a merge deploys nothing — every consumer pins
@v14and never readsmain. Production ships when the floating tag moves, by hand, per RELEASING.md.That is the Tier 1 shape exactly:
mainis this repo's staging, which is why auto-merging patch + minor onto it is safe.Changes
weeklydaily, 05:00 UTCWorth knowing
ignorecovers version updates only. A security major can still open a PR — the auto-merge workflow's update-type gate is what refuses to merge it. Both layers are needed.And a caveat recorded in the file itself, because it outlives this change: the
cigate here is actionlint only. It lints the YAML; it does not test that the reusables still work. A baddocker-build.ymlreaches every consumer the moment the tag moves, and the release gate is a human remembering to look.🤖 Generated with Claude Code