From 422ad766481ea92618b6cf7f8af4cb5ba642e3fa Mon Sep 17 00:00:00 2001 From: eFAILution Date: Mon, 14 Sep 2026 21:16:58 -0400 Subject: [PATCH 1/2] chore(ci): point Dependabot at beta Dependabot had no target-branch, so every ecosystem opened against the default branch. main is the stable release line: a push there cuts a stable GitHub release via release-it, so a routine dependency bump would ship one out of band. main also trails beta by everything not yet released, so bumps opened against it re-proposed versions beta already carried (#291, #292, #295 all duplicated bumps merged weeks earlier) and conflicted on the lockfile when retargeted. Updates now reach main the way everything else does, through the beta -> main release PR. --- .ai/decisions.yaml | 36 ++++++++++++++++++++++++++++++++++++ .github/dependabot.yml | 9 +++++++++ 2 files changed, 45 insertions(+) diff --git a/.ai/decisions.yaml b/.ai/decisions.yaml index 3867ad60..4a5b3a53 100644 --- a/.ai/decisions.yaml +++ b/.ai/decisions.yaml @@ -124,6 +124,42 @@ decisions: - .release-it/vscode-version.js - package.json (release:main, release:beta scripts) title: Release It + DEPENDABOT_TARGETS_BETA: + date: '2026-09-14' + status: accepted + context: Dependabot defaulted to the repository default branch (main), which is the stable + release line. Bumps opened there duplicated what had already landed on beta, and a merge + to main auto-cuts a stable release. + decision: 'Set target-branch: "beta" on every ecosystem in .github/dependabot.yml (npm, + github-actions, pip)' + rationale: + - A push to main runs release-it with .release-it.json and cuts a stable GitHub release, so + a routine dependency bump merged there ships a release out of band + - main trails beta by everything not yet released, so bumps against main duplicate versions + beta already carries (e.g. #291/#292/#295 re-proposed bumps merged weeks earlier) + - Retargeting such a PR to beta conflicts on package-lock.json, since beta has moved + - Updates reach main the same way every other change does, through the beta -> main release PR + implementation: + config: '.github/dependabot.yml, target-branch: "beta" on each of the three package-ecosystem + entries' + flow: dependabot -> beta -> release PR -> main + alternatives_considered: + - name: leave_targeting_main + rejected_because: Ships stable releases from dependency bumps and produces duplicate PRs + - name: retarget_each_pr_by_hand + rejected_because: Lockfile conflicts on every npm PR; recurring manual work + consequences: + positive: + - Dependency updates follow the same path as feature work + - No stable release cut by a dependency bump + - No duplicate bumps against a stale branch + negative: + - A security fix reaches main only when the next release PR merges + references: + - .github/dependabot.yml + - .release-it.json + - .release-it.beta.json + title: Dependabot Targets Beta MODULAR_SERVICE_SPLIT: date: '2026' status: accepted diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 8a8ce834..e83bba37 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,11 +6,18 @@ # in osv-scanner.toml that the Argus scan honors. Do NOT add a dev-dep `ignore:` here to suppress # those alerts -- `ignore:` also stops the version-update PRs below, which are how dev tools stay # current and how a transitive fix (e.g. serialize-javascript >= 7.0.5) actually lands. +# +# Every ecosystem below sets `target-branch: "beta"`. Without it Dependabot opens against the default +# branch (`main`), which is the STABLE release line: a push there auto-cuts a stable GitHub release, so a +# routine dependency bump would ship one out of band. `main` also trails `beta` by whatever has not been +# released yet, so bumps opened against it duplicate what already landed on `beta` and conflict on the +# lockfile when retargeted. Everything reaches `main` through the beta -> main release PR instead. version: 2 updates: # Maintain npm dependencies - package-ecosystem: "npm" directory: "/" + target-branch: "beta" schedule: interval: "weekly" day: "monday" @@ -68,6 +75,7 @@ updates: # Maintain GitHub Actions - package-ecosystem: "github-actions" directory: "/" + target-branch: "beta" schedule: interval: "weekly" day: "monday" @@ -85,6 +93,7 @@ updates: # Maintain pre-commit hooks - package-ecosystem: "pip" directory: "/" + target-branch: "beta" schedule: interval: "weekly" day: "monday" From d2ed56ea2a1ae4a27eea3926e3113c46218c6a11 Mon Sep 17 00:00:00 2001 From: eFAILution Date: Mon, 14 Sep 2026 21:17:05 -0400 Subject: [PATCH 2/2] docs(ci): correct the stale Argus workflow pin comment The comment claimed the SHA was Argus v1.11.0. It has been wrong since 1.12.0: the pin is now 1.12.4 (cc7ef8e), and v1.11.0 is 295eea9. A hand-written version next to a SHA drifts every time Dependabot bumps the SHA and nobody edits the line above it, so the comment now explains why the pin is a SHA and points at the PR title for the version instead of restating one. --- .github/workflows/security-hardening.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/security-hardening.yml b/.github/workflows/security-hardening.yml index 6ea3a05b..6c4ecfcb 100644 --- a/.github/workflows/security-hardening.yml +++ b/.github/workflows/security-hardening.yml @@ -19,7 +19,9 @@ permissions: jobs: argus-hardening: name: Argus Reusable Hardening - # Pinned to the commit for Argus v1.11.0 for supply-chain safety. + # SHA-pinned rather than tag-pinned for supply-chain safety: a tag can be moved, a commit cannot. + # Dependabot bumps this SHA and names the tag it resolves to in the PR title, so read the version there + # rather than trusting a hand-written one here (this comment claimed v1.11.0 through three bumps past it). uses: huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml@cc7ef8e7de85340368bf74e7c617e1a8f08ff5bb with: scanners: codeql,gitleaks,osv,dependency-review