infra: add Dependabot for Gradle and GitHub Actions - #16
Conversation
GabrielBBaldez
left a comment
GabrielBBaldez
left a comment
There was a problem hiding this comment.
Matches the library repo's config, which is what the issue asked for, and the reasoning is in the file rather than only in the PR — that is the part that survives.
One thing worth knowing for later rather than changing here. plugin/build.gradle.kts resolves the IDE it compiles against through intellijIdeaCommunity("2024.3.5"), which becomes a real Gradle dependency. If Dependabot's parser picks that up, it will start proposing IDE bumps — and moving the compile target is a compatibility decision, not maintenance: it shifts what the Plugin Verifier checks and can quietly raise the effective floor. If those PRs appear, an ignore entry for com.jetbrains.intellij.idea:* is the answer. If they never appear, nothing to do.
Merging.
…#25) The workflow has never once posted a comment. Every run was green, because a 403 on the POST only raises a ::warning::, and nobody reads a warning on a green run. pull_request_target: closed is the obvious trigger and cannot work here. A run triggered by a fork's pull request gets a read-only GITHUB_TOKEN whatever the repository's Workflow permissions say — setting that to write, which was done yesterday, does not reach it. Granting it means enabling "send write tokens to workflows from fork pull requests", which hands a write token to every fork-triggered run in the repository. That is not a trade worth making for a thank-you note. A push to main is not fork-triggered, so its token honours the permissions block. The PR behind the pushed commit comes from repos/:repo/commits/:sha/pulls rather than the commit subject, because squash writes "(#12)", a merge commit writes "Merge pull request #12", and a rebase merge writes neither. Confirmed on the real failure: ashudhanda's first merged PR (#16) counted correctly as 1 and then 403'd on the comment. workflow_dispatch with a pr input is kept so the path can be exercised without waiting for someone's first contribution.
|
Merged — thanks @ashudhanda, that's your first one here. If the project turned out to be useful to you, a ⭐ genuinely helps: stacktale is Either way you're welcome back — the |
2 participants
What changed
Added
.github/dependabot.ymlwith the two ecosystems requested in #14:gradle(weekly)github-actions(weekly)Following
stacktale/stacktale/.github/dependabot.ymlrather than inventing:gradle-minor-patch,actions-minor-patch) so a weekly run opens one PR per ecosystem instead of a handful, each of which would burn a full CI run including the Plugin Verifier's IDE downloads.As the issue notes,
intellijIdeaCommunity("2024.3.5")is left alone — Dependabot can't reason about the compile target, and bumping it is a compatibility decision.Verify
After merge: Insights → Dependency graph → Dependabot should show both ecosystems with a “last checked” time; the first grouped PR arriving with green CI is the real confirmation.
Closes #14