ci: stop grouping major bumps and let release PRs run their checks - #176
Merged
Conversation
Two configuration bugs kept producing pull requests that could never merge. Dependabot grouped every npm update under a single `*` pattern, so ten breaking majors arrived as one PR (#175): tailwindcss 3->4, zod 3->4 and typescript 5->7 each broke the build on their own, and typescript 7 is not supported by any released typescript-eslint. The group now batches only minor and patch updates; majors come as individual PRs that can be reviewed and migrated one at a time. release-please ran with the default GITHUB_TOKEN. GitHub deliberately does not start workflow runs for pull requests opened with that token, so the required lint-and-test check never ran on a release PR and every one of them stayed BLOCKED (#147 had to be nudged with an empty commit). Passing a PAT makes the PR author-created from Actions' point of view, which starts the checks. Requires a repository secret named RELEASE_PLEASE_TOKEN, a PAT with contents and pull-requests write scope. The expression falls back to GITHUB_TOKEN so the workflow keeps working until the secret exists.
jeremymcs
added a commit
that referenced
this pull request
Aug 20, 2026
release-please still opens this PR with the default GITHUB_TOKEN, so GitHub does not start workflow runs for it and the required lint-and-test check never runs. The permanent fix landed in #176 but stays inert until a RELEASE_PLEASE_TOKEN secret exists; until then each release PR needs one push from a user token.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two configuration bugs were generating pull requests that could never merge. Both surfaced while clearing the current PR backlog.
Dependabot grouped every npm update under one
*pattern. That produced #175: a single PR carrying ten major-version bumps. Three of them broke the build independently —typescript5→7 (no releasedtypescript-eslintsupports TS 7; 8.67.0 still caps at<6.1.0, sonpm cifailed peer resolution before any test ran),tailwindcss3→4 (PostCSS plugin moved to@tailwindcss/postcss, config format changed), andzod3→4 (.default({})no longer typechecks against the PR work contract schema inshared/schema.ts). A batch like that is not reviewable or landable as one unit. The group now batches onlyminorandpatch; majors arrive as individual PRs that can be migrated one at a time.release-please ran with the default
GITHUB_TOKEN. GitHub does not start workflow runs for pull requests opened with that token, so the requiredlint-and-testcheck never ran on a release PR — leaving every one of them permanentlyBLOCKED. #147 had been sitting in that state and needed an empty commit to nudge CI. Passing a PAT makes the PR author-created from Actions' point of view, which starts the checks normally.Action required before this takes effect
The release-please half needs a repository secret named
RELEASE_PLEASE_TOKEN— a PAT withcontents: writeandpull-requests: write. The expression is written assecrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN, so the workflow keeps working unchanged until the secret exists; it simply keeps the old behavior until then.Verification
yaml.safe_load).Related Issue