Repository navigation
Adopt the beamex Dependabot shape, and drop the PAT registry - #457
Merged
Merged
Conversation
Replaces the production/dev split with one group per ecosystem plus open-pull-requests-limit: 1. The split doubled PR count and CI and guaranteed a lockfile conflict between the two halves. The limit matters because Dependabot never closes superseded PRs (dependabot-core#3880), so the old groups accumulated competing PRs for the same group. Also drops the github-generoi registry and this repo's use of PACKAGIST_GITHUB_TOKEN, a PAT on the generoi-deploy machine user. Dependabot reads our private plugin repositories through the org-level repository-access grant instead. Schedule, directory, ignore and allow entries are preserved. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RztWiUfjeK1vQSw7KHjfCS
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two changes to
.github/dependabot.yml, done together because either one alone triggers a Dependabot run.1. One consolidated PR per ecosystem
Replaces the
production-dependencies/dev-dependenciessplit with a single group per ecosystem plusopen-pull-requests-limit: 1— the shape already running on beamex and 14 other sites.The split doubled the PR count and CI, guaranteed a
composer.lock/package-lock.jsonconflict between the two halves, and nobody reviews production and dev dependencies separately anyway.The limit is not optional here. Dependabot never closes superseded PRs (
dependabot-core#3880), so without a limit the old groups accumulated competing PRs for the same group — several repos in this sweep had two open PRs forproduction-dependenciesat once.2. The
github-generoiregistry goesWith it, this repo's use of
PACKAGIST_GITHUB_TOKEN, a classic PAT on thegeneroi-deploymachine user. Dependabot reaches our private plugin repositories through the org-level Grant Dependabot access to repositories setting instead — 61 private repos granted, built from everygeneroi/*reference across all 33 repos carrying this registry and closed over transitively. Narrower than the PAT, which can read 171.Proven on beamex: generoi/beamex#428 resolved
advanced-custom-fields-pro,gravityforms,polylang-proandtableberg-prowith no PAT in the config.What is preserved
Schedule (including deliberate bi-monthly and quarterly crons),
directory,ignoreentries,allow, and the npm registry — all untouched and verified unchanged before pushing.Before merging
Any open Dependabot PR for
production-dependenciesordev-dependenciesbecomes orphaned: its group no longer exists in the config, and it counts against the new limit of 1, so Dependabot would quietly open nothing. Close those first — the replacement consolidated PR includes everything they contained.🤖 Generated with Claude Code
https://claude.ai/code/session_01RztWiUfjeK1vQSw7KHjfCS