Skip to content

Commit c9c4e03

Browse files
chrisreddingtonchrisreddington
authored
Merge pull request #106 from github/dependabot/go_modules/go-dependencies-56301d3171
Bump the go-dependencies group across 1 directory with 8 updates
2 parents b5bdfbf + cc12b6f commit c9c4e03

File tree

15 files changed

+513
-115
lines changed

15 files changed

+513
-115
lines changed

‎.devcontainer/devcontainer.json‎

Lines changed: 34 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,44 @@
11
// For format details, see https://aka.ms/devcontainer.json. For config options, see the
22
// README at: https://github.com/devcontainers/templates/tree/main/src/go
33
{
4-
"name": "Go",
5-
// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
6-
"image": "mcr.microsoft.com/devcontainers/go:1-1.24-bookworm",
7-
"customizations": {
8-
"vscode": {
9-
"extensions": [
10-
"GitHub.codespaces",
11-
"github.vscode-github-actions",
12-
"GitHub.copilot",
13-
"GitHub.copilot-chat",
14-
"github.copilot-workspace",
15-
"GitHub.vscode-pull-request-github",
16-
"GitHub.remotehub",
17-
"golang.Go"
18-
]
19-
}
20-
},
21-
"tasks": {
22-
"build": "go build .",
23-
"test": "go test ./...",
24-
"run": "go run ."
25-
},
4+
"name": "Go",
5+
// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
6+
"image": "mcr.microsoft.com/devcontainers/go:1-1.24-bookworm",
7+
"customizations": {
8+
"vscode": {
9+
"extensions": [
10+
"GitHub.codespaces",
11+
"github.vscode-github-actions",
12+
"GitHub.copilot",
13+
"GitHub.copilot-chat",
14+
"github.copilot-workspace",
15+
"GitHub.vscode-pull-request-github",
16+
"GitHub.remotehub",
17+
"golang.Go"
18+
]
19+
}
20+
},
21+
"tasks": {
22+
"build": "go build .",
23+
"test": "go test ./...",
24+
"run": "go run ."
25+
},
2626

27-
// Features to add to the dev container. More info: https://containers.dev/features.
27+
// Features to add to the dev container. More info: https://containers.dev/features.
2828

29-
"features": {
30-
"ghcr.io/devcontainers/features/github-cli:1": {}
31-
},
29+
"features": {
30+
"ghcr.io/devcontainers/features/github-cli:1": {}
31+
},
3232

33-
// Use 'forwardPorts' to make a list of ports inside the container available locally.
34-
// "forwardPorts": [],
33+
// Use 'forwardPorts' to make a list of ports inside the container available locally.
34+
// "forwardPorts": [],
3535

36-
// Use 'postCreateCommand' to run commands after the container is created.
37-
"postCreateCommand": "go install -v golang.org/x/tools/cmd/goimports@latest"
36+
// Use 'postCreateCommand' to run commands after the container is created.
37+
"postCreateCommand": "go install -v golang.org/x/tools/cmd/goimports@latest"
3838

39-
// Configure tool-specific properties.
40-
// "customizations": {},
39+
// Configure tool-specific properties.
40+
// "customizations": {},
4141

42-
// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
43-
// "remoteUser": "root"
42+
// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
43+
// "remoteUser": "root"
4444
}

‎.github/dependabot.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ updates:
99
directory: "/" # Location of package manifests
1010
schedule:
1111
interval: "weekly"
12+
cooldown:
13+
default-days: 7
14+
semver-major-days: 7
1215
allow:
1316
- dependency-type: "direct"
1417
- dependency-type: "indirect"
@@ -20,6 +23,8 @@ updates:
2023
directory: "/" # Location of package manifests
2124
schedule:
2225
interval: "weekly"
26+
cooldown:
27+
default-days: 7
2328
groups:
2429
github-actions:
2530
patterns:

‎.github/instructions/dependabot.instructions.md‎

Lines changed: 196 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,196 @@
1+
---
2+
applyTo: "**/*dependabot.yml"
3+
description: Dependabot configuration patterns and best practices
4+
---
5+
6+
# Dependabot Configuration
7+
8+
Guidelines for configuring Dependabot version updates.
9+
10+
## Basic Structure
11+
12+
```yaml
13+
version: 2
14+
updates:
15+
- package-ecosystem: "gomod" # or npm, pip, docker, github-actions, etc.
16+
directory: "/"
17+
schedule:
18+
interval: "weekly" # daily, weekly, or monthly
19+
```
20+
21+
## Cooldown Settings
22+
23+
Configure cooldown periods to delay updates until packages have matured. This helps avoid churn from rapid releases. Cooldown only applies to version updates, not security updates.
24+
25+
```yaml
26+
cooldown:
27+
default-days: 7 # Default cooldown for all updates
28+
semver-major-days: 7 # Major version updates wait 7 days
29+
semver-minor-days: 3 # Minor version updates wait 3 days
30+
semver-patch-days: 1 # Patch version updates wait 1 day
31+
include:
32+
- "some-package*" # Only apply cooldown to matching packages
33+
exclude:
34+
- "critical-pkg*" # Skip cooldown for these packages
35+
```
36+
37+
**Parameters:**
38+
39+
| Parameter | Description |
40+
| ------------------- | ---------------------------------------------------------------- |
41+
| `default-days` | Default cooldown period for all dependencies |
42+
| `semver-major-days` | Cooldown for major version updates |
43+
| `semver-minor-days` | Cooldown for minor version updates |
44+
| `semver-patch-days` | Cooldown for patch version updates |
45+
| `include` | List of dependencies to apply cooldown (supports wildcards) |
46+
| `exclude` | List of dependencies excluded from cooldown (supports wildcards) |
47+
48+
**Notes:**
49+
50+
- If semver-specific days aren't defined, `default-days` is used
51+
- `exclude` takes precedence over `include`
52+
- Security updates automatically bypass cooldown
53+
54+
### SemVer Cooldown Support by Ecosystem
55+
56+
**IMPORTANT:** The `semver-major-days`, `semver-minor-days`, and `semver-patch-days` options are NOT supported by all package ecosystems. For unsupported ecosystems, use only `default-days`.
57+
58+
| Ecosystem | SemVer Cooldown Supported |
59+
| ---------------- | ------------------------------- |
60+
| `gomod` | ✅ Yes |
61+
| `npm` | ✅ Yes |
62+
| `pip` | ✅ Yes |
63+
| `bundler` | ✅ Yes |
64+
| `cargo` | ✅ Yes |
65+
| `composer` | ✅ Yes |
66+
| `maven` | ✅ Yes |
67+
| `gradle` | ✅ Yes |
68+
| `nuget` | ✅ Yes |
69+
| `docker` | ✅ Yes |
70+
| `github-actions` | ❌ No - use `default-days` only |
71+
| `gitsubmodule` | ❌ No - use `default-days` only |
72+
| `terraform` | ❌ No - use `default-days` only |
73+
74+
**Example for github-actions (no semver support):**
75+
76+
```yaml
77+
- package-ecosystem: "github-actions"
78+
directory: "/"
79+
schedule:
80+
interval: "weekly"
81+
cooldown:
82+
default-days: 7 # Only default-days is supported
83+
```
84+
85+
## Grouping Updates
86+
87+
Group related dependencies into single PRs to reduce noise:
88+
89+
```yaml
90+
updates:
91+
- package-ecosystem: "gomod"
92+
directory: "/"
93+
schedule:
94+
interval: "weekly"
95+
groups:
96+
go-dependencies:
97+
patterns:
98+
- "*" # Group all Go dependencies
99+
```
100+
101+
You can create multiple groups with specific patterns:
102+
103+
```yaml
104+
groups:
105+
aws-sdk:
106+
patterns:
107+
- "github.com/aws/*"
108+
testing:
109+
patterns:
110+
- "*test*"
111+
- "*mock*"
112+
dependency-type: "development"
113+
```
114+
115+
Group parameters:
116+
117+
- `patterns`: Include dependencies matching these patterns
118+
- `exclude-patterns`: Exclude dependencies matching these patterns
119+
- `dependency-type`: Limit to `development` or `production`
120+
- `update-types`: Limit to `minor`, `patch`, or `major`
121+
122+
## Filtering Dependencies
123+
124+
### Allow specific dependency types
125+
126+
```yaml
127+
allow:
128+
- dependency-type: "direct" # Only direct dependencies
129+
- dependency-type: "indirect" # Include transitive dependencies
130+
- dependency-type: "all" # All dependencies
131+
```
132+
133+
### Ignore specific dependencies
134+
135+
```yaml
136+
ignore:
137+
- dependency-name: "lodash"
138+
versions: ["4.x"] # Ignore lodash 4.x updates
139+
- dependency-name: "aws-sdk"
140+
update-types: ["version-update:semver-major"] # Ignore major updates
141+
```
142+
143+
## Common Ecosystems
144+
145+
| Ecosystem | `package-ecosystem` value |
146+
| -------------- | ------------------------- |
147+
| Go modules | `gomod` |
148+
| npm/Yarn | `npm` |
149+
| Python pip | `pip` |
150+
| Docker | `docker` |
151+
| GitHub Actions | `github-actions` |
152+
| Terraform | `terraform` |
153+
| Cargo (Rust) | `cargo` |
154+
| NuGet (.NET) | `nuget` |
155+
156+
## Complete Example
157+
158+
```yaml
159+
version: 2
160+
updates:
161+
# Go modules - supports semver cooldown
162+
- package-ecosystem: "gomod"
163+
directory: "/"
164+
schedule:
165+
interval: "weekly"
166+
cooldown:
167+
default-days: 7
168+
semver-major-days: 7
169+
allow:
170+
- dependency-type: "direct"
171+
- dependency-type: "indirect"
172+
groups:
173+
go-dependencies:
174+
patterns:
175+
- "*"
176+
177+
# GitHub Actions - does NOT support semver cooldown
178+
- package-ecosystem: "github-actions"
179+
directory: "/"
180+
schedule:
181+
interval: "weekly"
182+
cooldown:
183+
default-days: 7
184+
groups:
185+
github-actions:
186+
patterns:
187+
- "*"
188+
```
189+
190+
---
191+
192+
## References
193+
194+
- [Dependabot Configuration Options](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file) - Full configuration reference
195+
- [Supported Ecosystems](https://docs.github.com/en/code-security/dependabot/ecosystems-supported-by-dependabot/supported-ecosystems-and-repositories) - List of supported package ecosystems
196+
- [Optimizing PR Creation](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/optimizing-pr-creation-version-updates) - Cooldown and grouping strategies

0 commit comments

Comments
 (0)