chore(ci): point Dependabot at beta - #296
Merged
Merged
Conversation
Dependabot had no target-branch, so every ecosystem opened against the default branch. main is the stable release line: a push there cuts a stable GitHub release via release-it, so a routine dependency bump would ship one out of band. main also trails beta by everything not yet released, so bumps opened against it re-proposed versions beta already carried (#291, #292, #295 all duplicated bumps merged weeks earlier) and conflicted on the lockfile when retargeted. Updates now reach main the way everything else does, through the beta -> main release PR.
The comment claimed the SHA was Argus v1.11.0. It has been wrong since 1.12.0: the pin is now 1.12.4 (cc7ef8e), and v1.11.0 is 295eea9. A hand-written version next to a SHA drifts every time Dependabot bumps the SHA and nobody edits the line above it, so the comment now explains why the pin is a SHA and points at the PR title for the version instead of restating one.
Contributor
🛡️ Security Hardening Pipeline ResultsBranch: Workflow Run: 431 Scan Status
Summaries Collected: 4 Scanner Results🔬 CodeQL SAST (Javascript)Status: Completed Findings Summary
No security findings detected for Javascript. Artifacts: CodeQL Reports (Javascript) 🔗 Dependency ReviewStatus: ✅ No issues found No vulnerable or license-violating dependencies detected in this PR. 🔑 Gitleaks (Secrets)No 🔑 Gitleaks (Secrets) findings summary was produced. 📦 OSV (Dependencies)No 📦 OSV (Dependencies) findings summary was produced. Generated by Argus Generated by Argus |
This was referenced Sep 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Dependabot had no
target-branch, so all three ecosystems opened against the default branch. That is the wrong branch for this repo's release model, and it is why five stale bump PRs were sitting open.Type of Change
Changes Made
.github/dependabot.yml—target-branch: "beta"on thenpm,github-actionsandpipentries, with a header comment explaining why..ai/decisions.yaml— newDEPENDABOT_TARGETS_BETAdecision, sinceAGENTS.mddesignates.ai/as the specification and the release-flow decisions already live there..github/workflows/security-hardening.yml— the pin comment claimed Argus v1.11.0. It has been wrong since 1.12.0; the pin is now 1.12.4 (cc7ef8e), and v1.11.0 is295eea9. Rewritten to explain why the pin is a SHA and to point at the Dependabot PR title for the version, rather than restating a version that drifts every time the SHA is bumped and the line above it isn't.Why beta
Two reasons, either sufficient:
maincuts a stable release.ci.ymlruns release-it with.release-it.jsonon push, so merging a dependency bump tomainships a stable GitHub release out of band.maintrailsbetaby everything unreleased — 17 commits at the time of writing. Bumps opened against it re-propose versionsbetaalready carries. chore(deps-dev): bump fast-uri from 3.1.5 to 3.1.7 #291 (fast-uri 3.1.7), chore(deps): bump js-yaml from 4.2.0 to 4.3.2 #292 (js-yaml 4.3.2) and chore(deps-dev): bump mocha from 11.8.0 to 12.0.0 #295 (mocha 12.0.0) were all duplicates of bumps merged weeks earlier in chore(deps-dev): bump fast-uri from 3.1.5 to 3.1.7 #265, chore(deps): bump js-yaml from 4.2.0 to 4.3.2 #264 and chore(deps-dev): bump mocha from 11.8.0 to 12.0.0 #267, and retargeting them tobetaconflicts onpackage-lock.json.Updates reach
mainthe way everything else does, through the beta → main release PR (#271).Testing
.ai/decisions.yamlparses (yaml.safe_load, 15 decisions, new key present)..github/dependabot.ymlparses; the threetarget-branchkeys sit at the same indent as their siblingdirectory:keys.Related
Handled alongside this: #293 merged to
beta(Argus 1.12.4), #291/#292/#295 closed as superseded, #294 being rebuilt againstbetasince its lockfile no longer applies.Checklist