ci(dependabot): group minor and patch updates, disable npm auto-rebase

[moodyjmz]

Problem

js/ build output is committed, and npm-build.yml fails if the working tree is dirty after a build. So any bundled-dependency bump makes the committed assets stale and turns the PR red until someone comments /compile.

The per-PR cost is the small part. Every merge to a target branch invalidates the committed assets on every other open PR, so a backlog of N bumps isn't N compiles — it's up to N sequential rebase → /compile → merge cycles, because each merge stales the rest. Merging #82 immediately staled the others.

There are currently 17 open Dependabot PRs (11 on main, 6 on stable34), oldest from 2026-07-04, with four ungrouped ecosystem/branch blocks each at open-pull-requests-limit: 10.

Automating the compile isn't the fix: GitHub deliberately restricts tokens on Dependabot-triggered runs so a malicious dependency can't exfiltrate secrets, which is exactly why command-compile.yml is comment-triggered behind a permission check. The lever available is reducing the number of PRs.

Changes

Grouping

Each npm block gets three groups. Groups are first-match, so order matters:

Group	Catches	Why
npm-production	direct dependencies	bundle regression narrows to the runtime half
npm-development	direct devDependencies	tooling churn kept separate from the bundle
npm-other	everything else — i.e. transitive	dependency-type doesn't cover indirect deps for npm

That third group is doing more work than it looks. dependency-type applies to direct dependencies only, and npm isn't among the ecosystems where it extends to indirect ones, so a production/development split alone would leave transitive bumps arriving as individual PRs — "any outdated dependencies that do not match a rule are updated in individual pull requests."

That's not a marginal case. Four of the ten currently open npm PRs on main are transitive — immutable (#80), fast-uri (#81), postcss (#93) and axios (#94, transitive because the manifest declares @nextcloud/axios) — and dompurify in #82 was as well. Those bundled transitive runtime deps are precisely the ones that need a /compile, so omitting the catch-all would have left the most expensive class of PR untouched.

Majors stay ungrouped on main so they keep arriving individually for review. On stable34 the existing ignore rule already limits updates to patches, so those groups need no update-types.

Auto-rebase and cooldown

rebase-strategy: "disabled" on the npm blocks. A rebase without a recompile leaves CI red regardless, so auto-rebasing every open PR on each merge just burns CI runs across the whole queue. Composer keeps auto-rebase — those PRs pass without a recompile.

To be transparent about the evidence here: this mirrors nextcloud/server, which sets the same option with the comment "Disable automatic rebasing because without a build CI will likely fail anyway". However, rebase-strategy does not appear in the current Dependabot options reference, and I have not verified that a manual @dependabot rebase comment still works while it is disabled. Since the rebase → /compile → merge recipe depends on manual rebasing, that's worth confirming on the first grouped PR. Happy to drop this hunk and land the grouping alone if maintainers would rather not take it on trust.

cooldown (4 days, 8 for majors) so rapid successive releases of the same dependency collapse into one update instead of one PR each. Cooldown applies to version updates only — security updates are explicitly not delayed by it.

Trade-off worth stating

Grouping introduces head-of-line blocking: one bad dependency now blocks its whole group, where previously seven of eight PRs could merge independently. The production/development split limits the blast radius, and an offender can be pulled out with an ignore entry, but it is a genuine cost rather than a free win.

Grouping also shortens the merge-order treadmill rather than eliminating it — each merge still stales the remaining open PRs. The point is that it's a handful of cycles a week instead of seventeen.

Precedent

nextcloud/server commits its dist/ output and uses this same combination — groups, rebase-strategy: "disabled" on npm, and cooldown.

Notes

• Config only; no effect until Dependabot next evaluates the schedule (Saturdays 03:00 Europe/Paris).
• Worth merging before clearing the existing backlog, otherwise the merge-order cycle gets paid ~16 more times and Saturday's run rebuilds the queue anyway.
• Existing open PRs aren't retroactively grouped — Dependabot will supersede them with grouped PRs as it re-evaluates, or they can be merged/closed as usual.

🤖 Generated with Claude Code