Dependabot grouping

Left to its defaults, Dependabot opens one pull request for every dependency that has a newer version. Terrarium groups updates instead: its minor and patch npm updates share one group while a major npm update still arrives alone, and its GitHub Actions updates of every size share another.

Know Dependabot groups already? Skip to In Terrarium.

In Terrarium

In .github/dependabot.yml, the npm entry has one group:

12    groups:
13      npm-minor-patch:
14        update-types: [minor, patch]

It takes every minor and patch update. A major update matches no rule and arrives as a pull request of its own. The Actions entry groups by name instead:

17  - package-ecosystem: github-actions
18    directories: [/, /.github/actions/gate]
19    schedule:
20      interval: weekly
21    cooldown:
22      default-days: 3
23    groups:
24      github-actions:
25        patterns: ["*"]

patterns: ["*"] takes every update, whatever its size. For Actions, / reads only .github/workflows/ and a root action.yml; the second directory adds .github/actions/gate, where the GateThe fixed set of machine checks every change must pass before it merges. It runs locally and in CI, and the CI run decides.GLOSSARY.md's composite action lives (Composite actions). Each entry sets default-days: 3, which restates the default cooldown.

A RoutineA timer, set outside the repo, that starts a session to run one Skill on a schedule. The Skill says what the run does; the Routine says only when.GLOSSARY.md runs the dependabot-sweep SkillA folder of instructions for one repeatable job, committed with the code, that a session runs when the job comes up.GLOSSARY.md (.agents/skills/dependabot-sweep/SKILL.md), which reviews each Dependabot pull request: it turns a major update into an issue, and lands an npm minor or patch pull request only when its checks are green, no release notes show a breaking or deprecation change that affects Terrarium, it adds no direct dependency and no bumped package is 0.x. It lands one with scripts/github/merge-pr.ts, whose dependabotBumpRefusal applies the Dependabot exception in ADR-0004 (docs/adr/0004-objective-safety-gate.md). For an Actions pull request, the sweep posts its verdict and a person merges it. merge-pr.ts never checks a Dependabot pull request against the Human-onlySaid of a file whose changes a person with write access must merge, whatever the Gate says. Agents may still edit it. The one exception is a minor or patch npm bump that Dependabot opens from the repo itself, that changes only package.json and the lockfile, and that stays within each package's major version (a 0.x minor counts as a major).GLOSSARY.md list, and .github/dependabot.yml isn't on that list.

Where next

• LessonMerge gate
• LessonPull requests
• LessonAuthor trust
• LessonProtected paths
• LessonComposite actions