From 9559cab41c1649a0cd80c8928475131510ea9a19 Mon Sep 17 00:00:00 2001 From: Ruben van der Linde Date: Thu, 6 Aug 2026 13:16:10 +0200 Subject: [PATCH] chore(ci): point Dependabot at development, where the gates actually run MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Dependabot targeted the DEFAULT branch `main`, which is 729 commits behind `development` and carries a different lockfile. Two consequences, both bad: 1. The alert list measured the wrong tree. Open alerts claimed 5 critical / 51 high; `development` actually had 1 critical / 2 high on npm and ZERO composer advisories (the critical twig/twig <3.26.0 alert is moot there — development is on 3.27.0). 2. The PRs were ungated. #368 and #369 collected no check runs at all beyond a neutral CodeQL, because `main` still carries the old self-contained code-quality workflow. An unverified dependency PR is how this fleet previously shipped an unbuildable image for two months. Also adds the missing composer and github-actions ecosystems — composer had no entry, so its only PRs were security updates against main. Trade-off is stated in the file: security updates only ever target the default branch, so these become version updates. A verified version update on development beats an unmergeable security update on a dead main. --- .github/dependabot.yml | 50 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 3390c9e5..fa03d48f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,7 +1,36 @@ version: 2 + +# ⚠️ `target-branch: development` is load-bearing, not cosmetic. +# +# Without it Dependabot targets the repository DEFAULT branch, which is `main`. +# `main` is currently **729 commits behind `development`** and carries an +# entirely different lockfile, so the PRs Dependabot raised there were: +# +# • measured against a tree nobody develops on — the open alerts claimed +# 5 critical / 51 high, while `development` actually had 1 critical / +# 2 high (npm) and ZERO composer advisories; and +# • ungated — `code-quality.yml` on `main` is a stale, self-contained +# workflow, and PRs #368 and #369 collected **no check runs at all** +# beyond a neutral CodeQL. A dependency PR that nothing builds is exactly +# how this fleet previously shipped an unbuildable image for two months. +# +# Pointing Dependabot at `development` puts its PRs in front of the real +# shared quality workflow (build, unit tests, SBOM, licence and audit legs). +# +# Trade-off, stated explicitly: GitHub only raises Dependabot SECURITY updates +# against the default branch, so setting `target-branch` converts these to +# VERSION updates. That is a net gain here — a version update on `development` +# is verified and mergeable, whereas a security update on `main` was neither. +# The alert list itself still tracks `main` and will only shrink as +# `development` is released forward. +# +# Matches the fleet convention already in place on nldesign, decidesk, +# openbuild, procest and shillinq. + updates: - package-ecosystem: "npm" directory: "/" + target-branch: "development" schedule: interval: "weekly" open-pull-requests-limit: 10 @@ -11,3 +40,24 @@ updates: - "*" exclude: - "@conduction/*" + + # composer had no entry at all, so the only composer PRs this repo ever saw + # were security updates against `main` (e.g. #369, which bumped twig to + # 3.27.0 — a version `development` already had). + - package-ecosystem: "composer" + directory: "/" + target-branch: "development" + schedule: + interval: "weekly" + open-pull-requests-limit: 10 + cooldown: + default-days: 1 + include: + - "*" + + - package-ecosystem: "github-actions" + directory: "/" + target-branch: "development" + schedule: + interval: "weekly" + open-pull-requests-limit: 5