Skip to content

Run Dependabot independently on each branch #158361

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hugovk merged 5 commits into from
Sep 29, 2026
+119 −3
Merged

Run Dependabot independently on each branch #158361

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
9b80971
Run Dependabot independently on each branch
hugovk Sep 28, 2026
857e767
Compact
hugovk Sep 29, 2026
04735ae
Repeat for backport branches
hugovk Sep 29, 2026
8fb8496
Group pip updates into a single PR
hugovk Sep 29, 2026
11747cd
Do pip updates for bugfix branches
hugovk Sep 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
122 changes: 119 additions & 3 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,12 +16,128 @@ updates:
# Cooldowns protect against supply chain attacks by avoiding the
# highest-risk window immediately after new releases.
default-days: 14

- package-ecosystem: "pip"
directory: "/Tools/"
schedule:
interval: "quarterly"
labels:
- "skip issue"
- "skip news"
labels: ["skip issue", "skip news"]
groups:
pip:
patterns: ["*"]
cooldown:
default-days: 14

# Release branches: Dependabot only reads this file from the default
# branch, so each branch that should get its own actions bumps needs an
# entry here with `target-branch`. Add one when a new release branch is
# created, and remove when the branch reaches end-of-life.
- package-ecosystem: "github-actions"
target-branch: "3.15"
directory: "/"
schedule:
interval: "quarterly"
labels: ["skip issue", "skip news"]
groups:
actions:
patterns: ["*"]
cooldown:
default-days: 14

- package-ecosystem: "github-actions"
target-branch: "3.14"
directory: "/"
schedule:
interval: "quarterly"
labels: ["skip issue", "skip news"]
groups:
actions:
patterns: ["*"]
cooldown:
default-days: 14

- package-ecosystem: "github-actions"
target-branch: "3.13"
directory: "/"
schedule:
interval: "quarterly"
labels: ["skip issue", "skip news"]
groups:
actions:
patterns: ["*"]
cooldown:
default-days: 14

- package-ecosystem: "github-actions"
target-branch: "3.12"
directory: "/"
schedule:
interval: "quarterly"
labels: ["skip issue", "skip news"]
groups:
actions:
patterns: ["*"]
cooldown:
default-days: 14

- package-ecosystem: "github-actions"
target-branch: "3.11"
directory: "/"
schedule:
interval: "quarterly"
labels: ["skip issue", "skip news"]
groups:
actions:
patterns: ["*"]
cooldown:
default-days: 14

- package-ecosystem: "github-actions"
target-branch: "3.10"
directory: "/"
schedule:
interval: "quarterly"
labels: ["skip issue", "skip news"]
groups:
actions:
patterns: ["*"]
cooldown:
default-days: 14

# Only bump bugfix branches for pip. Remove
# the entry when branch goes security-only.
- package-ecosystem: "pip"

@ezio-melotti ezio-melotti Sep 28, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would move this to the top, so that all the main sections are together. Perhaps it should also be duplicated for all branches.

@hugovk hugovk Sep 29, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Duplicated for bugfix branches only: updating mypy for security branches may need code changes which we don't want to do for security. Hypothesis is the other pip thing, which I'm not sure needs regular updates for security either. We can do manual backports if something is needed?

Moved to the top, so we have:

  • GHA main
  • pip main
  • GHA bugfix+security
  • pip bugfix

I also added grouping for pip updates, so we get a single PR per branch instead of several per branch.

target-branch: "3.15"
directory: "/Tools/"
schedule:
interval: "quarterly"
labels: ["skip issue", "skip news"]
groups:
pip:
patterns: ["*"]
cooldown:
default-days: 14

- package-ecosystem: "pip"
target-branch: "3.14"
directory: "/Tools/"
schedule:
interval: "quarterly"
labels: ["skip issue", "skip news"]
groups:
pip:
patterns: ["*"]
cooldown:
default-days: 14

- package-ecosystem: "pip"
target-branch: "3.13"
directory: "/Tools/"
schedule:
interval: "quarterly"
labels: ["skip issue", "skip news"]
groups:
pip:
patterns: ["*"]
cooldown:
default-days: 14
Loading