ci(deps): drop Dependabot auto-merge - #136
Merged
Merged
Conversation
Auto-merge was there to absorb volume, back when Dependabot opened about thirteen pull requests a month. Grouping them by ecosystem and by semver impact brought that down to three, so the saving is now marginal while the risk is unchanged. A patch bump can still carry a breaking change that the smoke-level e2e does not reach, and npm ci runs install scripts inside the runner before the merge rather than after. Dependabot also targets main, the production branch, so a bot merge there would be looser than the review this repo now requires on develop. Three pull requests a month read in minutes. Keep the human in the loop on the only code entering the repository from outside. Removes the workflow, so allow_auto_merge no longer needs enabling.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Auto-merge was there to absorb volume, back when Dependabot opened about thirteen pull requests a month. Grouping by ecosystem and by semver impact (#135) brought that down to three, so the saving is now marginal while the risk is unchanged.
Reasons to drop it:
npm ciruns a package install scripts inside the runner before the merge, not after. The 7 day cooldown narrows that window but does not close it.main, the production branch. A bot merging there would be looser than the review this repo now requires ondevelop.Three pull requests a month read in minutes, and the human stays in the loop on the only code entering the repository from outside.
Removes
.github/workflows/dependabot-automerge.yml, soallow_auto_mergeno longer needs enabling on the repository. The grouping, the cooldown and the CI coverage ondevelopfrom #135 are untouched.