Skip to content

add dependabot #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Zahnentferner merged 7 commits into from
May 17, 2026
Merged

add dependabot #5

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
8237844
add dependabot
kpj2006 Dec 25, 2025
5e516bd
remove duplicate
kpj2006 Dec 25, 2025
e595daf
left
kpj2006 Dec 25, 2025
63de15e
Delete .github/CODEOWNERS
kpj2006 Feb 20, 2026
b39bd99
Merge branch 'AOSSIE-Org:main' into dependabot
kpj2006 Feb 20, 2026
8c889d7
refine dependabot without review
kpj2006 Feb 20, 2026
524ed84
use -instead of / for better readbility
kpj2006 Feb 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .github/CODEOWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
# Default code owners for this repository.
Copy link
Copy Markdown
Contributor

@Zahnentferner Zahnentferner Dec 25, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We do have a problem where many of our repos are lacking reliable maintainers.

A CODEOWNERS file could potentially help with this. But I am not entirely convinced.

Isn't it possible to automatically infer the code owners from the previous contributors?

We have the convention of having, for every project P, a team with the same name P. Wouldn't it be possible to automatically assign ownership of project P to the team P?

Otherwise, I am afraid that CODEOWNERS could become another bureaucratic boilerplate.

What we really need, I think, is a workflow that automatically assigns open PRs in a project P to be reviewed to members of team P and notifies them of this assignment. This would hopefully help in encouraging them to maintain the code.

# TEMPLATE PLACEHOLDER:
# Replace the owners below with your org/user/team.

* @kpj2006 @Zahnentferner
255 changes: 255 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,255 @@
# See help here: https://docs.github.com/en/free-pro-team@latest/github/administering-a-repository/enabling-and-disabling-version-updates

version: 2
updates:
# Enable version updates for npm
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "09:00"
open-pull-requests-limit: 5
reviewers:
- "AOSSIE-Org/maintainers"
assignees:
- "AOSSIE-Org/maintainers"
labels:
- "dependencies"
- "npm"
commit-message:
prefix: "chore(deps)"
include: "scope"
pull-request-branch-name:
separator: "/"

# Enable version updates for GitHub Actions
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "09:00"
open-pull-requests-limit: 5
reviewers:
- "AOSSIE-Org/maintainers"
assignees:
- "AOSSIE-Org/maintainers"
labels:
- "dependencies"
- "github-actions"
commit-message:
prefix: "chore(deps)"
include: "scope"

# Enable version updates for Docker
- package-ecosystem: "docker"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "09:00"
open-pull-requests-limit: 5
reviewers:
- "AOSSIE-Org/maintainers"
assignees:
- "AOSSIE-Org/maintainers"
labels:
- "dependencies"
- "docker"
commit-message:
prefix: "chore(deps)"
include: "scope"

# Enable version updates for bundler (Ruby)
- package-ecosystem: "bundler"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "09:00"
open-pull-requests-limit: 5
reviewers:
- "AOSSIE-Org/maintainers"
assignees:
- "AOSSIE-Org/maintainers"
labels:
- "dependencies"
commit-message:
prefix: "chore(deps)"
include: "scope"

# Enable version updates for Cargo (Rust)
- package-ecosystem: "cargo"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "09:00"
open-pull-requests-limit: 5
reviewers:
- "AOSSIE-Org/maintainers"
assignees:
- "AOSSIE-Org/maintainers"
labels:
- "dependencies"
commit-message:
prefix: "chore(deps)"
include: "scope"

# Enable version updates for Maven (Java)
- package-ecosystem: "maven"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "09:00"
open-pull-requests-limit: 5
reviewers:
- "AOSSIE-Org/maintainers"
assignees:
- "AOSSIE-Org/maintainers"
labels:
- "dependencies"
commit-message:
prefix: "chore(deps)"
include: "scope"

# Enable version updates for Gradle (Java)
- package-ecosystem: "gradle"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "09:00"
open-pull-requests-limit: 5
reviewers:
- "AOSSIE-Org/maintainers"
assignees:
- "AOSSIE-Org/maintainers"
labels:
- "dependencies"
commit-message:
prefix: "chore(deps)"
include: "scope"

# Enable version updates for Composer (PHP)
- package-ecosystem: "composer"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "09:00"
open-pull-requests-limit: 5
reviewers:
- "AOSSIE-Org/maintainers"
assignees:
- "AOSSIE-Org/maintainers"
labels:
- "dependencies"
commit-message:
prefix: "chore(deps)"
include: "scope"

# Enable version updates for Go modules
- package-ecosystem: "gomod"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "09:00"
open-pull-requests-limit: 5
reviewers:
- "AOSSIE-Org/maintainers"
assignees:
- "AOSSIE-Org/maintainers"
labels:
- "dependencies"
commit-message:
prefix: "chore(deps)"
include: "scope"

# Enable version updates for Poetry (Python AI/ML projects)
- package-ecosystem: "pip"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "09:00"
open-pull-requests-limit: 5
reviewers:
- "AOSSIE-Org/maintainers"
assignees:
- "AOSSIE-Org/maintainers"
labels:
- "dependencies"
- "python"
- "ai-ml"
commit-message:
prefix: "chore(deps)"
include: "scope"
ignore:
# Ignore major version updates for ML frameworks to prevent breaking changes
- dependency-name: "tensorflow"
update-types: ["version-update:semver-major"]
- dependency-name: "torch"
update-types: ["version-update:semver-major"]
- dependency-name: "scikit-learn"
update-types: ["version-update:semver-major"]
Comment thread
kpj2006 marked this conversation as resolved.
Outdated

# Enable version updates for Terraform (Infrastructure)
- package-ecosystem: "terraform"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "09:00"
open-pull-requests-limit: 5
reviewers:
- "AOSSIE-Org/maintainers"
assignees:
- "AOSSIE-Org/maintainers"
labels:
- "dependencies"
- "infrastructure"
commit-message:
prefix: "chore(deps)"
include: "scope"

# Enable version updates for Pub (Dart/Flutter - Blockchain DApps)
- package-ecosystem: "pub"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "09:00"
open-pull-requests-limit: 5
reviewers:
- "AOSSIE-Org/maintainers"
assignees:
- "AOSSIE-Org/maintainers"
labels:
- "dependencies"
- "flutter"
commit-message:
prefix: "chore(deps)"
include: "scope"

# Enable version updates for NuGet (.NET - Blockchain projects)
- package-ecosystem: "nuget"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "09:00"
open-pull-requests-limit: 5
reviewers:
- "AOSSIE-Org/maintainers"
assignees:
- "AOSSIE-Org/maintainers"
labels:
- "dependencies"
- "dotnet"
commit-message:
prefix: "chore(deps)"
include: "scope"
Comment on lines +22 to +262
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial

Aggregate PR volume can reach 70 with all ecosystems active — consider groups or multi-ecosystem-groups.

Each ecosystem independently caps at 5 open PRs, so a polyglot repository that actually uses all 14 ecosystems could accumulate up to 70 concurrent Dependabot PRs. Two mitigation strategies are worth noting in the customization guide:

  1. Per-ecosystem groups: Batch all updates for an ecosystem into a single PR (already GA).
  2. multi-ecosystem-groups (currently in beta): Dependabot's multi-ecosystem groups feature allows you to create groups that span multiple package ecosystems and get a single PR with updates across all supported ecosystems, instead of receiving separate PRs for each ecosystem.

Adding a brief mention of these options under the CUSTOMIZATION GUIDE section would help adopters proactively manage review load.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/dependabot.yml around lines 23 - 241, The file currently enables
many package-ecosystem entries which can produce up to ~70 concurrent Dependabot
PRs; update the customization guide to recommend and show how to use
per-ecosystem "groups" and the beta "multi-ecosystem-groups" to batch updates
and reduce PR volume, and mention adjusting "open-pull-requests-limit" per
ecosystem; look for the package-ecosystem blocks and the
open-pull-requests-limit keys to add a short explanatory note describing when to
use "groups" vs "multi-ecosystem-groups" and what trade-offs to expect.