chore(renovate): P3b — remove Dependabot config from consumer template - #2401
Merged
Conversation
Completes the per-consumer Dependabot removal (P3a) on the source side: the consumer template no longer ships .github/dependabot.yml, so maint-68 stops re-adding it to consumers that had it removed (create_only re-creates a missing file — without this, every re-sync would resurrect Dependabot and re-open the dual-run). New consumers get only the Renovate fleet preset. Removes templates/consumer-repo/.github/dependabot.yml + its sync-manifest entry. Leaves dependabot-automerge.yml + maint-dependabot-* for P4 cleanup (they no-op without Dependabot PRs and don't cause the re-add). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
Workflow source neededPR #2401 needs either a linked GitHub issue or one valid non-issue Workflow Source before PR metadata automation can manage it safely. Please do one of:
Once a valid source is present, this warning will not be reposted. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5083d94057
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| description: "Dependabot config - ignores dev tools synced via maint-52" | ||
| sync_mode: create_only | ||
|
|
||
| # Renovate configuration - extends the shared fleet preset (renovate-presets/fleet.json). |
There was a problem hiding this comment.
This deletion leaves selftest-ci broken for non-doc PRs: .github/workflows/selftest-ci.yml runs tests/workflows/, and tests/workflows/test_consumer_sync_create_only_evidence.py:24-30 still asserts that .github/dependabot.yml is present in the manifest with sync_mode: create_only. Once this entry is removed, that assertion fails in CI, so the test expectation needs to be updated along with the manifest change.
Useful? React with 👍 / 👎.
Contributor
Automated Status SummaryHead SHA: 6828075
Coverage Overview
Updated automatically; will refresh on subsequent CI/Docker completions. Keepalive checklistScopeNo scope information available Tasks
Acceptance criteria
|
stranske
added a commit
that referenced
this pull request
Jun 15, 2026
) #2401 intentionally removed templates/consumer-repo/.github/dependabot.yml and its sync-manifest entry (create_only sync would otherwise resurrect Dependabot on consumers). test_consumer_create_only_files_are_manifested still asserted .github/dependabot.yml was manifested, turning Python Tests and every scenario python-3.12 job (+ the Aggregate/Publish roll-ups) red on every PR. Drops the stale expectation and adds a guard that the entry is NOT re-added. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
stranske
added a commit
that referenced
this pull request
Jun 15, 2026
…rtion P3b (#2401) removed `.github/dependabot.yml` from the consumer template and sync-manifest, but test_consumer_create_only_files_are_manifested still asserted it was manifested as create_only — leaving main red on the Python Tests gate job. Drop the stale assertion; pr-00-gate.yml and ci.yml remain the create-only entries checked. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
stranske
added a commit
that referenced
this pull request
Jun 15, 2026
… up the two pre-existing CI failures) (#2402) * fix(workflows): add error_classifier.js to sparse-checkout of root workflows github-api-with-retry.js does a top-level `require('./error_classifier')`, but ~20 root workflows sparse-checkout the retry client WITHOUT error_classifier.js. Any step that loads the client (require) throws `Cannot find module './error_classifier'`. Adds `.github/scripts/error_classifier.js` to every sparse-checkout block that pulls github-api-with-retry.js (28 insertions across 20 files, including all three multi-block files). Mirrors the consumer-template fix in PR #2398. Prioritized reusables consumers call: reusable-10-ci-python, reusable-16-agents, reusable-70-orchestrator-{init,main}, reusable-agents-pr-health, reusable-bot-comment-handler. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(sync): stop expecting dependabot.yml in create_only manifest (#2401) #2401 intentionally removed templates/consumer-repo/.github/dependabot.yml and its sync-manifest entry (create_only sync would otherwise resurrect Dependabot on consumers). test_consumer_create_only_files_are_manifested still asserted .github/dependabot.yml was manifested, turning Python Tests and every scenario python-3.12 job (+ the Aggregate/Publish roll-ups) red on every PR. Drops the stale expectation and adds a guard that the entry is NOT re-added. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(drift): refresh stale Health-74 template-drift fingerprints The allowlist already covers all 8 drifting pairs, but their fingerprints went stale (renovate bumps, #2398 template edits, and this PR's error_classifier sparse-checkout additions), so Health-74 reported them as unallowlisted drift and failed. Recomputed every entry's normalized SHA in place via scripts/check_template_drift.py: the 7 still-valid entries are unchanged; the 8 stale entries (pair.1,5,6,7,8,9,11,15) are refreshed. Checker now reports 0 unallowlisted drift (exit 0). Divergence is the intentional health-74 baseline (root floating tags + concurrency vs. template SHA-pins); re-baselined, not aligned. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
stranske
added a commit
that referenced
this pull request
Jun 15, 2026
…2404) * fix(deps): regenerate stale requirements.lock + reconcile pytest pin Renovate's #2389 bumped requirements.txt (langchain 1.3.4->1.3.9, langchain-core 1.4.3->1.4.7, langchain-anthropic 1.4.4->1.4.6, langchain-openai 1.3.0->1.3.2, faiss-cpu 1.14.2->1.14.3, tomlkit 0.14.0->0.15.0) but did NOT update requirements.lock. Renovate's pip-compile manager is not enabled in the fleet preset, so it does not regenerate this uv-pip-compile lock. The reusable Python CI installs `-r requirements.lock` (reusable-10-ci-python.yml), so the stale lock meant CI was installing pre-#2389 deps. Regenerating also surfaced unsatisfiable inputs: requirements.txt pinned pytest==9.0.3 while pyproject.toml's dev extra (and the committed lock) pin pytest==9.1.0. pytest is a dev-tool excluded from Renovate (fleet preset), so it never got bumped in requirements.txt and drifted. This unsatisfiable conflict is also why maint-51-dependency-refresh has been failing on every scheduled run since ~March. Aligned requirements.txt to the authoritative pin (9.1.0). Lock regenerated with the canonical command (no --upgrade, to respect existing pins rather than bump beyond #2389): uv pip compile --python-version 3.12 pyproject.toml \ --extra dev --extra langchain requirements.txt --universal -o requirements.lock Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(test): drop .github/dependabot.yml from create-only manifest assertion P3b (#2401) removed `.github/dependabot.yml` from the consumer template and sync-manifest, but test_consumer_create_only_files_are_manifested still asserted it was manifested as create_only — leaving main red on the Python Tests gate job. Drop the stale assertion; pr-00-gate.yml and ci.yml remain the create-only entries checked. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Merged
23 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Source-side completion of P3. The consumer template no longer ships
.github/dependabot.yml, somaint-68stops re-adding it to consumers that had it removed in P3a (create_onlyre-creates a missing file — without this, every re-sync resurrects Dependabot and reopens dual-run). New consumers get only the Renovate fleet preset. Removes the template file + its sync-manifest entry;dependabot-automerge/maint-dependabot-*left for P4 (they no-op without Dependabot PRs). health-70 template-completeness passes.🤖 Generated with Claude Code