From 80626852fc8b879a097c7ef68d9775dd5bcc4541 Mon Sep 17 00:00:00 2001 From: Davood Tofighi Date: Fri, 4 Sep 2026 22:35:15 -0600 Subject: [PATCH] chore(ci): pin dependabot to dev, drop npm updates, bump prettier - Add target-branch: dev to github-actions block. Without it, dependabot derives the base from the repo default (main) and resets it on every rebase, so a manual PR retarget can never stick (observed on #503, #512). - Drop the npm package-ecosystem block entirely. package.json has no runtime dependencies -- only 3 devDependencies (husky, lint-staged, prettier) that never reach a user, since flow-cli ships as zsh through Homebrew. Of the last 16 npm dependabot PRs, 9 were closed unmerged and only 6 merged, each costing a full CI run (ZSH Plugin Tests ~7min). github-actions updates merged 3/3 and cover real security surface (e.g. #444 bumped actions/create-github-app-token, later hardened by #514). - Bump prettier 3.9.4 -> 3.9.6 by hand (same version #503 proposed), superseding #503 -- closed as no longer needed. Verified: prettier --check against this branch and against origin/dev produce identical pre-existing warnings/errors (archive docs, test fixtures) -- nothing newly introduced by this change. --- .github/dependabot.yml | 30 +++++++++++++----------------- package-lock.json | 8 ++++---- package.json | 2 +- 3 files changed, 18 insertions(+), 22 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b624db54c..3a7da43e5 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,25 +1,21 @@ version: 2 updates: - # Enable version updates for npm - - package-ecosystem: 'npm' - directory: '/' - schedule: - interval: 'weekly' - day: 'monday' - time: '09:00' - open-pull-requests-limit: 5 - reviewers: - - 'dt' - commit-message: - prefix: 'chore(deps)' - include: 'scope' - labels: - - 'dependencies' - - 'automated' - # GitHub Actions updates + # + # npm version updates were removed here (2026-09-04): package.json has no + # runtime `dependencies`, only 3 devDependencies (husky, lint-staged, + # prettier) that never reach a user — flow-cli ships as zsh through + # Homebrew. Of the last 16 npm dependabot PRs, 9 were closed unmerged and + # only 6 merged, each costing a full CI run (ZSH Plugin Tests alone ~7min). + # github-actions updates merged 3/3 and cover real security surface (e.g. + # #444 bumped actions/create-github-app-token, the action #514 later + # hardened) — kept. - package-ecosystem: 'github-actions' directory: '/' + # Open PRs against the integration branch. Without this, dependabot derives + # the base from the repo default (main) and RESETS it on every rebase, so a + # manual retarget to dev can never stick (observed on #503 and #512). + target-branch: 'dev' schedule: interval: 'weekly' day: 'monday' diff --git a/package-lock.json b/package-lock.json index 5da012323..de212d208 100644 --- a/package-lock.json +++ b/package-lock.json @@ -11,7 +11,7 @@ "devDependencies": { "husky": "^9.1.7", "lint-staged": "^17.4.1", - "prettier": "^3.9.4" + "prettier": "^3.9.6" } }, "node_modules/husky": { @@ -68,9 +68,9 @@ } }, "node_modules/prettier": { - "version": "3.9.4", - "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.4.tgz", - "integrity": "sha512-yWG/o/4oJfo036EKAfK6ACAoDOfHeRHx4tuxkfBZiauURiaSmYwlpOr5LQqKtIkRD2z1PLteme2WoxEnj4tHTg==", + "version": "3.9.6", + "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.6.tgz", + "integrity": "sha512-OpN0zzVdiaiAhxpuuj5efpIS4sY9j7bY6uR5mnj5yPzGkdkjNKSJeUThPb60Jw29QuAZgA4o+/iB49kFiaBX6g==", "dev": true, "license": "MIT", "bin": { diff --git a/package.json b/package.json index 4b8bdb7a1..1b48edbe0 100644 --- a/package.json +++ b/package.json @@ -27,7 +27,7 @@ "devDependencies": { "husky": "^9.1.7", "lint-staged": "^17.4.1", - "prettier": "^3.9.4" + "prettier": "^3.9.6" }, "lint-staged": { "*.{json,md,yml,yaml}": [