ci: consolidate Dependabot npm updates to the pnpm workspace root

[EricAndrechek]

Problem

Every Dependabot npm PR has been failing CI since the #190 root-lockfile consolidation — e.g. #211 (@vitest/coverage-v8 in tests/e2e/sdk) and #337 (the docs group). They fail fast on Lint/Unit/E2E/Coverage and a rebase never fixes them.

Root cause is the Dependabot config, not the dependencies. The repo is a pnpm workspace with a single root pnpm-lock.yaml, but .github/dependabot.yml pointed its three npm entries at the member directories (directory: /docs, /clients/ts, /tests/e2e/sdk). Dependabot only updates a lockfile co-located with the manifest it targets, so it edited the member package.json but left the root lockfile untouched. CI then runs pnpm install --frozen-lockfile, the lockfile's recorded specifier no longer matches package.json, and it aborts with ERR_PNPM_OUTDATED_LOCKFILE. A rebase only replays the same package.json-only change onto fresh main — it never regenerates the lockfile, so the mismatch returns every run. (#337, created well after #190, fails identically — confirming it's structural, not a stale branch.)

Fix

Replace the three per-member npm entries with one entry at the workspace root (directory: /, group npm-deps, prefix deps). At the root, Dependabot reads pnpm-workspace.yaml, walks every member, and updates the single root lockfile inside the PR. As a bonus it now also covers the root package.json's own devDeps (biome, markdownlint, nyc), which the per-member configs never did.

Trade-off: one combined weekly npm PR with a single deps: prefix, instead of three per-area PRs (docs: / deps(sdk): / deps(tests):). This matches the existing grouped go-deps / actions-deps configs and the team's stated preference for fewer Monday PRs.

Docs sync

• docs/src/content/docs/development.md — Dependabot section: five configs → three, plus the root-lockfile rationale.
• SECURITY.md — supply-chain line: "three npm workspaces" → one root npm config.
• CHANGELOG.md — [Unreleased] → Changed entry.

Note (out of scope)

pnpm-workspace.yaml sets minimumReleaseAge: 10080 (7-day cooldown), which Dependabot doesn't honor. When the new config regenerates lockfiles, a dep released <7 days ago can be held by the cooldown at install time — so a freshly-cut bump may need a few days before it merges cleanly. Pre-existing; the no-auto-merge + admin-review gate covers it.

Follow-up on the broken PRs

Once this merges, the old per-member configs no longer exist, so #211 and #337 should be closed (not rebased — rebasing keeps the old member-directory branch and reproduces the failure). The new root config regenerates correct combined PRs on the next Dependabot run.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2561039b-5f2f-4369-93f2-9719dd777d26

📥 Commits

Reviewing files that changed from the base of the PR and between 26b9866 and 8ceeacb.

📒 Files selected for processing (4)

• .github/dependabot.yml
• CHANGELOG.md
• SECURITY.md
• docs/src/content/docs/development.md

📜 Recent review details

⏰ Context from checks skipped due to timeout of 300000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)

• GitHub Check: E2E tests
• GitHub Check: Coverage
• GitHub Check: Integration tests
• GitHub Check: Docs build
• GitHub Check: Lint
• GitHub Check: Analyze (go)
• GitHub Check: Analyze (go)

🧰 Additional context used

📓 Path-based instructions (1)

docs/src/content/docs/**/*.{md,mdx}

📄 CodeRabbit inference engine (AGENTS.md)

docs/src/content/docs/**/*.{md,mdx}: Author Mermaid diagrams vertically (flowchart TB/TD) to fit page column width (~46–58rem); reserve LR for genuinely short chains (≤3–4 nodes)
Keep Mermaid node labels short; use
for a second line rather than one long line; lean on semantic node classes (wh, win, pain, fail, infra, neutral, store, client)
Never sit two large diagrams side-by-side; wrap comparisons in

…

to stack them vertically

Files:

• docs/src/content/docs/development.md

🧠 Learnings (1)

📚 Learning: 2026-06-10T15:01:09.027Z

Learnt from: EricAndrechek
Repo: Wave-RF/WaveHouse PR: 312
File: docs/src/content/docs/development.md:0-0
Timestamp: 2026-06-10T15:01:09.027Z
Learning: In this repo’s Markdown review (all .md files), do not flag capitalization/style issues for literal paths starting with ".github/" (or any substring that is a path beginning with ".github/"). Treat ".github" as the correct lowercase dotfile directory name, even when it appears inside prose or code spans; automated checks such as LanguageTool’s "(GITHUB)" rule commonly produce false positives for this literal filesystem path.

Applied to files:

• SECURITY.md
• docs/src/content/docs/development.md
• CHANGELOG.md

🪛 LanguageTool

docs/src/content/docs/development.md

[uncategorized] ~522-~522: The official name of this software platform is spelled with a capital “H”.
Context: ...Dependabot Dependabot is configured in .github/dependabot.yml to open weekly grouped ...

(GITHUB)

🔇 Additional comments (4)

.github/dependabot.yml (1)

30-56: LGTM!

CHANGELOG.md (1)

24-24: LGTM!

SECURITY.md (1)

31-31: LGTM!

docs/src/content/docs/development.md (1)

522-528: LGTM!

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Consolidated npm/TypeScript dependency updates into a single weekly pull request instead of separate per-area updates
  • Updated documentation to reflect the new Dependabot configuration strategy
  • Improved CI stability by addressing lockfile synchronization issues in the monorepo

Walkthrough

Dependabot's npm configuration was consolidated from three workspace-specific entries into a single root-level configuration targeting the pnpm workspace root. This change prevents CI failures caused by outdated lockfiles when per-member manifests are updated. Documentation, security policy, and changelog entries were updated to reflect the new consolidated strategy.

Changes

Dependabot Configuration Consolidation

Layer / File(s)	Summary
Workspace-root npm configuration consolidation .github/dependabot.yml	Three separate npm configs targeting /docs, /clients/ts, and /tests/e2e/sdk were replaced with a single config at directory: / using group npm-deps and commit prefix deps, enabling Dependabot to update the shared root pnpm-lock.yaml in a single weekly grouped PR.
Documentation and changelog updates CHANGELOG.md, SECURITY.md, docs/src/content/docs/development.md	Changelog entry documents the consolidation and its rationale for fixing ERR_PNPM_OUTDATED_LOCKFILE failures. Security policy and development docs updated to describe weekly grouped PRs for three ecosystems (Go modules, GitHub Actions, and npm at workspace root) instead of five separate npm configurations.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested labels

dependencies, documentation, area/docs, area/infra

Suggested reviewers

• taitelee

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: consolidating Dependabot npm updates to the pnpm workspace root, which is the core objective of this PR.
Description check	✅ Passed	The description thoroughly explains the problem (CI failures from outdated lockfiles), root cause (per-member Dependabot configs not updating root lockfile), the fix (single root-level entry), trade-offs, and documentation changes—all directly related to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot-pnpm-root

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch dependabot-pnpm-root

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

📚 Docs preview is live → https://2a03efe5-wavehouse-docs.wave-rf.workers.dev

• Commit — 8ceeacb: ci: consolidate Dependabot npm updates to the pnpm workspace root
• Author — @EricAndrechek, Claude Opus 4.8 (1M context)
• Committed — 2026-06-11 10:57 (UTC-04:00)
• Deployed — 2026-06-11 11:24 EDT

[github-code-quality]

Code Coverage Overview

Languages: Go

Go

The overall coverage remains at 89%, unchanged from the main branch.

---

_{Code Coverage is in Public Preview. Learn more and provide us with your feedback.}