Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ci(deps): group Dependabot updates by devDeps vs prod deps #12890

Merged
merged 1 commit into from
May 2, 2024

Commits on Apr 4, 2024

  1. ci(deps): group Dependabot updates by devDeps vs prod deps

    - per https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#groups
      - note that `applies-to` is necessary as it defaults to `version-updates` per the docs
        - I thought it would default to _both_, but they seem to be mutually exclusive in `applies-to`? we don't use `version-updates` in any case though
    
    - generally, security updates for prod deps should be backported, while devDeps are not strictly necessary
      - so splitting these is helpful for cherry-picking, especially if there might be conflicts (which may be more likely with devDeps and build chain changes)
    
    Signed-off-by: Anton Gilgur <agilgur5@gmail.com>
    agilgur5 committed Apr 4, 2024
    Configuration menu
    Copy the full SHA
    78c1856 View commit details
    Browse the repository at this point in the history