chore(ci): group github-actions dependabot updates - #63
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
变更
给
dependabot.yml的github-actionsecosystem 增加groups（patterns*），把零散的 action 更新合并进同一条 PR，与已有的gomod分组做法保持一致。为什么
github-actions之前没有分组，Dependabot 会把github/codeql-action/init和github/codeql-action/analyze当成两个独立依赖，各开一条 PR。CodeQL 要求两步版本一致，单独合并任何一条都会让Analyze Go失败：结果这些 PR 永远无法变绿、无人合并，下个版本发布时又被新的 PR 取代，形成持续的 PR churn（过去一个多月 codeql-action 相关 PR 开了 13 条，仅 #53 成功合并）。
分组后 init/analyze 会落在同一条 PR 里，版本始终一致。
验证
python -c "import yaml; yaml.safe_load(open('.github/dependabot.yml'))"通过