Repository navigation
ci: configure Dependabot for Bun + GitHub Actions, drop package-lock.json - #15
Merged
Merged
Conversation
…json
Root-cause fix for the npm/bun mismatch: Dependabot was set up for the npm
ecosystem and only updated package-lock.json, but the build runs 'bun install'
against bun.lock — so its PRs touched a lockfile nothing uses.
- Add .github/dependabot.yml:
- package-ecosystem: bun -> updates bun.lock directly (Bun >= 1.1.39)
- package-ecosystem: github-actions -> keeps the new SHA pins + version
comments current
- group minor/patch into one PR (majors stay separate for review)
- Remove package-lock.json: unused (deploy/CI use bun), unreferenced anywhere,
and would otherwise go stale under the bun ecosystem.
Verified: bun install --frozen-lockfile clean + bun run build (15 pages) with
package-lock.json removed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root-cause fix for the npm/bun mismatch behind the recent dependency PR cleanup (#8–#11): Dependabot was configured for the npm ecosystem and only updated
package-lock.json, but the build runsbun installagainstbun.lock— so its PRs touched a lockfile nothing uses, and couldn't be merged as-is.Changes
.github/dependabot.yml:package-ecosystem: bun→ updatesbun.lockdirectly (Dependabot Bun support, requires Bun ≥ 1.1.39; repo uses 1.3.14)package-ecosystem: github-actions→ keeps the newly SHA-pinned actions (and their# vX.Y.Zcomments) currentpackage-lock.json: unused (deploy & CI use bun), unreferenced anywhere in the repo, and would go stale under the bun ecosystem.Verification
bun install --frozen-lockfileclean +bun run build(15 pages) withpackage-lock.jsonremoveddependabot.ymlYAML validated🤖 Generated with Claude Code