From cdc0a5845f73ca026bb4db030ad4dd1712cd2b63 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ricardo=20Gro=C3=9F?= Date: Sun, 16 Aug 2026 14:48:41 +0200 Subject: [PATCH] ci: keep Dependabot off action majors on the publish path Dependabot's first PR after #13 (#15) bumps download-artifact to v8, which stops auto-unzipping and would leave the publish job's dist/*.nupkg glob finding a zip. Majors on the publish path are a deliberate change with a test behind it; minors and patches still arrive weekly. release.yml now carries the note explaining why the artifact actions stay on v6/v7. Same rule as EFCore.ComplexIndexes #25. Co-Authored-By: Claude Fable 5 --- .github/dependabot.yml | 6 ++++++ .github/workflows/release.yml | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 68a0798..87d7a01 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -2,6 +2,9 @@ # # github-actions keeps the SHA-pinned actions in the workflows current — a pin without an update # path just ages. Weekly, one grouped PR, so a security release in an action is not waiting a month. +# Majors are excluded: this is the publish path, and release.yml documents why upload-artifact +# stays on v6 and download-artifact on v7 (v8 stops auto-unzipping, which would break the push +# step). A major is a deliberate change with a test behind it, not a Monday PR. # # nuget covers the test projects only. The shipping projects under src/ are deliberately excluded: # their EF Core provider and NodaTime references are the floors consumers restore against — @@ -18,6 +21,9 @@ updates: groups: actions: patterns: [ "*" ] + ignore: + - dependency-name: "*" + update-types: [ "version-update:semver-major" ] - package-ecosystem: nuget directories: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8c9f971..d245704 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -149,6 +149,12 @@ jobs: printf 'Packages (%d):\n' "${#packages[@]}" printf ' %s\n' "${packages[@]##*/}" + # upload-artifact v6 and download-artifact v7 are the majors that switched to the Node 24 + # runtime. Deliberately not the newest majors: upload v7 adds ESM and direct (unzipped) + # uploads, and download v8 turns a digest mismatch into a hard failure and stops + # auto-unzipping — which would leave the publish job's dist/*.nupkg glob finding a zip. + # Neither buys anything here, and this is the publish path; dependabot.yml excludes majors + # for that reason. - name: Upload packages uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: