From 4bf421b699399b7e034d93a7cc7ee781b8bd839b Mon Sep 17 00:00:00 2001 From: Jeremy McSpadden Date: Tue, 18 Aug 2026 03:40:29 -0500 Subject: [PATCH] ci: stop grouping major bumps and let release PRs run their checks Two configuration bugs kept producing pull requests that could never merge. Dependabot grouped every npm update under a single `*` pattern, so ten breaking majors arrived as one PR (#175): tailwindcss 3->4, zod 3->4 and typescript 5->7 each broke the build on their own, and typescript 7 is not supported by any released typescript-eslint. The group now batches only minor and patch updates; majors come as individual PRs that can be reviewed and migrated one at a time. release-please ran with the default GITHUB_TOKEN. GitHub deliberately does not start workflow runs for pull requests opened with that token, so the required lint-and-test check never ran on a release PR and every one of them stayed BLOCKED (#147 had to be nudged with an empty commit). Passing a PAT makes the PR author-created from Actions' point of view, which starts the checks. Requires a repository secret named RELEASE_PLEASE_TOKEN, a PAT with contents and pull-requests write scope. The expression falls back to GITHUB_TOKEN so the workflow keeps working until the secret exists. --- .github/dependabot.yml | 7 +++++++ .github/workflows/release-please.yml | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5841a64..e9da268 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -5,9 +5,16 @@ updates: schedule: interval: weekly groups: + # Only minor and patch updates are safe to batch. Grouping majors here + # once produced a single PR carrying ten breaking upgrades (tailwindcss 4, + # zod 4, typescript 7 and more), which could not be reviewed or landed as + # one unit. Majors now arrive as individual PRs. npm-dependencies: patterns: - "*" + update-types: + - minor + - patch - package-ecosystem: github-actions directory: / diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index a9414aa..88ce3a6 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -33,6 +33,13 @@ jobs: steps: - uses: googleapis/release-please-action@v5 id: release + with: + # GitHub does not start workflow runs for pull requests opened with the + # default GITHUB_TOKEN, so the required lint-and-test check never ran on + # release PRs and every one of them sat permanently BLOCKED. A PAT makes + # the PR look author-created, which starts the checks. Falls back to the + # default token so the workflow still runs if the secret is absent. + token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }} publish-npm: needs: release-please