chore(deps): consolidate dependabot config with groups and cooldowns - #2245
Merged
Conversation
…pm tracking - Consolidate 7 Docker blocks into 1 using multi-directory syntax - Add image-family groups (golang, azurelinux, windows, ubuntu) - Add gomod groups for k8s, cilium, aws-sdk, azure-sdk, otel (patch-only) - Add GitHub Actions patch group - Add npm ecosystem for /site (Docusaurus) with docusaurus group - Configure cooldown periods to reduce PR churn - Majors remain standalone PRs for careful review Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>
Quang Nguyen (nddq)
requested review from
Beegii Khurelsukh (BeegiiK) and
Yilin (xiaozhiche320)
April 23, 2026 16:18
Retina Code Coverage ReportTotal coverage no changeIncreased diff
|
ibezrukavyi
approved these changes
Apr 23, 2026
Laksh (lakshk98)
pushed a commit
to lakshk98/retina
that referenced
this pull request
Aug 4, 2026
…icrosoft#2245) # Description Currently the Dependabot config has 7 separate Docker blocks (one per Dockerfile directory) running daily, no dependency grouping for gomod, and no tracking for the `/site` npm packages. This generates ~9 individual PRs/week and misses Docusaurus version updates entirely. This PR consolidates and optimizes `.github/dependabot.yaml`: - **Docker**: Collapse 7 blocks into 1 using multi-directory `directories:` syntax, switch from daily to weekly, and group by image family (`golang-base`, `azurelinux-base`, `windows-base`, `ubuntu-base`) - **Go modules**: Add patch-only groups for `k8s`, `cilium`, `aws-sdk`, `azure-sdk`, and `otel` families — minors and majors remain standalone for review - **GitHub Actions**: Add `actions-patch` group for patch-only bundling - **npm**: Add `/site` (Docusaurus) tracking with weekly schedule and `docusaurus` group for `@docusaurus/*` / `@mdx-js/*` patches - **Cooldowns**: 7d default / 30d major for Docker and gomod; 3d / 14d for actions; 7d / 30d for npm - **Cleanup**: Remove `inspektor-gadget` ignore (no longer used) ## Related Issue N/A ## Checklist - [x] I have read the [contributing documentation](https://retina.sh/docs/Contributing/overview). - [x] I signed and signed-off the commits (`git commit -S -s ...`). See [this documentation](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification) on signing commits. - [x] I have correctly attributed the author(s) of the code. - [x] I have tested the changes locally. - [x] I have followed the project's style guidelines. - [ ] I have updated the documentation, if necessary. (config-only change) - [ ] I have added tests, if applicable. (config-only change) ## Screenshots (if applicable) or Testing Completed N/A — config-only change. ## Additional Notes - `directories:` (plural) requires GitHub-hosted Dependabot (which this repo uses). See [GitHub changelog](https://github.blog/changelog/2024-06-25-simplified-dependabot-yml-configuration-with-multi-directory-key-directories-and-wildcard-glob-support/). - Security updates bypass cooldown windows automatically — no CVE delay risk. - Docker groups deliberately don't restrict `update-types` since digest-only re-pins don't reliably classify as "patch" in Dependabot's semver model. Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>
Laksh (lakshk98)
pushed a commit
to lakshk98/retina
that referenced
this pull request
Aug 4, 2026
…icrosoft#2245) # Description Currently the Dependabot config has 7 separate Docker blocks (one per Dockerfile directory) running daily, no dependency grouping for gomod, and no tracking for the `/site` npm packages. This generates ~9 individual PRs/week and misses Docusaurus version updates entirely. This PR consolidates and optimizes `.github/dependabot.yaml`: - **Docker**: Collapse 7 blocks into 1 using multi-directory `directories:` syntax, switch from daily to weekly, and group by image family (`golang-base`, `azurelinux-base`, `windows-base`, `ubuntu-base`) - **Go modules**: Add patch-only groups for `k8s`, `cilium`, `aws-sdk`, `azure-sdk`, and `otel` families — minors and majors remain standalone for review - **GitHub Actions**: Add `actions-patch` group for patch-only bundling - **npm**: Add `/site` (Docusaurus) tracking with weekly schedule and `docusaurus` group for `@docusaurus/*` / `@mdx-js/*` patches - **Cooldowns**: 7d default / 30d major for Docker and gomod; 3d / 14d for actions; 7d / 30d for npm - **Cleanup**: Remove `inspektor-gadget` ignore (no longer used) ## Related Issue N/A ## Checklist - [x] I have read the [contributing documentation](https://retina.sh/docs/Contributing/overview). - [x] I signed and signed-off the commits (`git commit -S -s ...`). See [this documentation](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification) on signing commits. - [x] I have correctly attributed the author(s) of the code. - [x] I have tested the changes locally. - [x] I have followed the project's style guidelines. - [ ] I have updated the documentation, if necessary. (config-only change) - [ ] I have added tests, if applicable. (config-only change) ## Screenshots (if applicable) or Testing Completed N/A — config-only change. ## Additional Notes - `directories:` (plural) requires GitHub-hosted Dependabot (which this repo uses). See [GitHub changelog](https://github.blog/changelog/2024-06-25-simplified-dependabot-yml-configuration-with-multi-directory-key-directories-and-wildcard-glob-support/). - Security updates bypass cooldown windows automatically — no CVE delay risk. - Docker groups deliberately don't restrict `update-types` since digest-only re-pins don't reliably classify as "patch" in Dependabot's semver model. Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Currently the Dependabot config has 7 separate Docker blocks (one per Dockerfile directory) running daily, no dependency grouping for gomod, and no tracking for the
/sitenpm packages. This generates ~9 individual PRs/week and misses Docusaurus version updates entirely.This PR consolidates and optimizes
.github/dependabot.yaml:directories:syntax, switch from daily to weekly, and group by image family (golang-base,azurelinux-base,windows-base,ubuntu-base)k8s,cilium,aws-sdk,azure-sdk, andotelfamilies — minors and majors remain standalone for reviewactions-patchgroup for patch-only bundling/site(Docusaurus) tracking with weekly schedule anddocusaurusgroup for@docusaurus/*/@mdx-js/*patchesinspektor-gadgetignore (no longer used)Related Issue
N/A
Checklist
git commit -S -s ...). See this documentation on signing commits.Screenshots (if applicable) or Testing Completed
N/A — config-only change.
Additional Notes
directories:(plural) requires GitHub-hosted Dependabot (which this repo uses). See GitHub changelog.update-typessince digest-only re-pins don't reliably classify as "patch" in Dependabot's semver model.