From 9c558560de2c1b5394178cfbb14437c8905c3d04 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Fri, 28 Aug 2026 10:18:57 -0700 Subject: [PATCH 1/2] Exclude Fleet Toolchain Packages From Grouped Dependabot Bumps (#1062) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary `catalog/snippets/configs/dependabot.yml`'s reference config grouped every package in an ecosystem into one catch-all PR (`patterns: ["*"]`), with no exclusion for the fleet's own lint/format toolchain packages. A formatter or linter version bump can change its own output or rule set and start flagging previously-compliant code the bump never touched, so bundling it into the catch-all group means one tool's self-bump can block an arbitrary number of unrelated, otherwise-mergeable dependency bumps together, indefinitely, with no obvious signal why. ## Evidence Investigated live via `ptr727/ProjectTemplate#1055` ("Dependabot PRs stuck BLOCKED despite auto-merge enabled and all checks green"). That issue's premise doesn't hold — every affected PR checked has a real, currently-failing required check, so `mergeStateStatus: BLOCKED` is GitHub behaving correctly. One of the confirmed root causes is this hub template gap: - `ptr727/PhotoCleaner#81`-`#84`: a 13-update `nuget-deps` group bump included `csharpier` 1.2.6 -> 1.3.0. The new csharpier version reformats raw string literals differently, so `dotnet csharpier check .` now flags pre-existing, previously-compliant code (`PhotoCleaner/Database.cs`) that the bump never touched — holding the other 12 unrelated, harmless updates in the same PR hostage. Full findings (this repo and two others) posted as a comment on #1055. ## Change Add `exclude-patterns` to the `nuget-deps` and `pypi-deps` groups, naming the fleet-standard toolchain package names per `.agents/skills/dotnet-codestyle/SKILL.md` and `.agents/skills/python-codestyle/SKILL.md`: - `nuget-deps`: `csharpier`, `husky`, `dotnet-outdated-tool` - `pypi-deps`: `ruff`, `pyright`, `mypy` Each excluded package falls out of the catch-all group and gets its own individual PR instead, diagnosable and mergeable (or holdable) on its own. `actions-deps` is left unchanged — the third repo in #1055's report (ESPHome-Config) hit a different, already-tracked cause (`docs/eol-lf-rollout.md`), not a grouping/hostage problem. ## Verification - `python3 -c "import yaml; yaml.safe_load(open('catalog/snippets/configs/dependabot.yml'))"` — valid YAML. - `scripts/prose_lint.py` and `scripts/repo_gate.py` — both clean. - Pre-commit hooks ran clean on commit. 🤖 Generated with [Claude Code](https://claude.com/claude-code) ## Summary by CodeRabbit * **Documentation** * Documented dependency update exclusions for .NET and Python tooling. * Clarified which development tools are excluded from automated update groups across main and develop branches. --- catalog/snippets/configs/dependabot.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/catalog/snippets/configs/dependabot.yml b/catalog/snippets/configs/dependabot.yml index 1e15d0c7..ed6fd8ca 100644 --- a/catalog/snippets/configs/dependabot.yml +++ b/catalog/snippets/configs/dependabot.yml @@ -9,6 +9,11 @@ # Because develop is strictly forward-only, each branch absorbs its own PRs. # Security (CVE) PRs always target the default branch regardless of target-branch. # Keep only the ecosystems the repo actually ships. +# +# Each group's exclude-patterns keeps the fleet's own lint/format toolchain packages out of the catch-all bump. +# A formatter or linter version bump can change its own output or rule set and start flagging previously-compliant code it never touched. +# Grouping it with unrelated dependency bumps would then block all of them together on one tool's reformat/relint debt. +# Excluded packages instead get their own individual PR, diagnosed and merged (or held) on its own. version: 2 updates: @@ -21,6 +26,10 @@ updates: nuget-deps: patterns: - "*" + exclude-patterns: + - "csharpier" + - "husky" + - "dotnet-outdated-tool" - package-ecosystem: "nuget" target-branch: "develop" @@ -31,6 +40,10 @@ updates: nuget-deps: patterns: - "*" + exclude-patterns: + - "csharpier" + - "husky" + - "dotnet-outdated-tool" - package-ecosystem: "github-actions" target-branch: "main" @@ -63,6 +76,10 @@ updates: pypi-deps: patterns: - "*" + exclude-patterns: + - "ruff" + - "pyright" + - "mypy" - package-ecosystem: "uv" target-branch: "develop" @@ -73,3 +90,7 @@ updates: pypi-deps: patterns: - "*" + exclude-patterns: + - "ruff" + - "pyright" + - "mypy" From 4ba79f9e894faa5f669e25ce63279a3f6800dcab Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Fri, 28 Aug 2026 10:46:34 -0700 Subject: [PATCH 2/2] Tighten Dependabot Exclude-Patterns Rationale Comment (#1064) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Qodo flagged the 4-line rationale comment added in #1062 as an elaborative prose block, against the fleet's "one line is the default, a second line is earned only by a constraint the code cannot otherwise carry" comment rule (found on the #1063 promotion PR, whose diff doesn't allow a direct fix, hence this separate feature PR). Trims it to the two sentences that carry the non-obvious why, dropping the lines that restated what the code already shows. ## Verification - `scripts/prose_lint.py catalog/snippets/configs/dependabot.yml` — clean. - `scripts/repo_gate.py` — clean. - YAML syntax check — valid. 🤖 Generated with [Claude Code](https://claude.com/claude-code) ## Summary by CodeRabbit * **Documentation** * Clarified Dependabot configuration comments about toolchain exclusions and version updates. * Documented how tool version changes may affect existing code and grouped updates. --- catalog/snippets/configs/dependabot.yml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/catalog/snippets/configs/dependabot.yml b/catalog/snippets/configs/dependabot.yml index ed6fd8ca..e2b8de31 100644 --- a/catalog/snippets/configs/dependabot.yml +++ b/catalog/snippets/configs/dependabot.yml @@ -10,10 +10,8 @@ # Security (CVE) PRs always target the default branch regardless of target-branch. # Keep only the ecosystems the repo actually ships. # -# Each group's exclude-patterns keeps the fleet's own lint/format toolchain packages out of the catch-all bump. -# A formatter or linter version bump can change its own output or rule set and start flagging previously-compliant code it never touched. -# Grouping it with unrelated dependency bumps would then block all of them together on one tool's reformat/relint debt. -# Excluded packages instead get their own individual PR, diagnosed and merged (or held) on its own. +# Exclude-patterns keeps the fleet's toolchain packages out of the catch-all bump. +# A tool's own version bump can flag previously-compliant code, blocking the whole group over it. version: 2 updates: