Skip to content

ci: keep Dependabot off action majors on the publish path #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
CaffeinatedCoder merged 1 commit into from
Aug 16, 2026
Merged

ci: keep Dependabot off action majors on the publish path #16

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,9 @@
#
# github-actions keeps the SHA-pinned actions in the workflows current — a pin without an update
# path just ages. Weekly, one grouped PR, so a security release in an action is not waiting a month.
# Majors are excluded: this is the publish path, and release.yml documents why upload-artifact
# stays on v6 and download-artifact on v7 (v8 stops auto-unzipping, which would break the push
# step). A major is a deliberate change with a test behind it, not a Monday PR.
#
# nuget covers the test projects only. The shipping projects under src/ are deliberately excluded:
# their EF Core provider and NodaTime references are the floors consumers restore against —
Expand All @@ -18,6 +21,9 @@ updates:
groups:
actions:
patterns: [ "*" ]
ignore:
- dependency-name: "*"
update-types: [ "version-update:semver-major" ]

- package-ecosystem: nuget
directories:
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,6 +149,12 @@ jobs:
printf 'Packages (%d):\n' "${#packages[@]}"
printf ' %s\n' "${packages[@]##*/}"

# upload-artifact v6 and download-artifact v7 are the majors that switched to the Node 24
# runtime. Deliberately not the newest majors: upload v7 adds ESM and direct (unzipped)
# uploads, and download v8 turns a digest mismatch into a hard failure and stops
# auto-unzipping — which would leave the publish job's dist/*.nupkg glob finding a zip.
# Neither buys anything here, and this is the publish path; dependabot.yml excludes majors
# for that reason.
- name: Upload packages
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
with:
Expand Down
Loading