diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 251f3cdf..355cad91 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,5 +1,8 @@ # Dependabot: keep Python dependencies and GitHub Actions up to date. # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file +# +# Weekly checks open grouped PRs for routine minor/patch bumps so review stays +# focused. Major version bumps stay ungrouped for individual review. version: 2 updates: @@ -7,10 +10,26 @@ updates: directory: / schedule: interval: weekly + day: monday open-pull-requests-limit: 5 + groups: + python-minor-and-patch: + patterns: + - "*" + update-types: + - "minor" + - "patch" - package-ecosystem: github-actions directory: / schedule: interval: weekly + day: monday open-pull-requests-limit: 5 + groups: + github-actions-minor-and-patch: + patterns: + - "*" + update-types: + - "minor" + - "patch" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 214a1382..afd9a7ce 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -129,7 +129,8 @@ jobs: env: BASE_REF: ${{ github.base_ref }} run: | - git fetch --depth=1 origin "$BASE_REF" + # Full base history so range checks still work after main advances. + git fetch --no-tags origin "$BASE_REF" python scripts/check_changelog.py - name: Check documentation freshness run: python scripts/check_doc_freshness.py @@ -295,9 +296,11 @@ jobs: with: fetch-depth: 0 - name: Fetch base branch for diff-cover + # Full history (not --depth=1): a shallow tip of the base branch has no + # merge-base with the PR when main advances after the branch was cut. env: BASE_REF: ${{ github.base_ref }} - run: git fetch --no-tags --depth=1 origin "$BASE_REF" + run: git fetch --no-tags origin "$BASE_REF" - name: Install uv uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 with: diff --git a/CHANGELOG.md b/CHANGELOG.md index 6633de27..49414151 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -39,6 +39,18 @@ omit pure CI/refactor bullets and point readers here. See exams are preserved on the run warning list (they previously dropped because no `ExamResult` was created). +### Changed + +- **Dependabot weekly grouped minor/patch bumps** (2026-08-03) — `.github/dependabot.yml` + still runs weekly (Monday) for `pip` and `github-actions`, but routine minor/patch + updates are grouped into one PR per ecosystem (`python-minor-and-patch`, + `github-actions-minor-and-patch`). Major version bumps stay ungrouped for individual + review. +- **CI base-branch fetch for coverage/changelog** (2026-08-03) — `coverage-pr` and the + changelog check fetch the PR base with full history instead of `--depth=1`, so + `diff-cover` / range diffs keep a merge-base when `main` advances after the branch + was opened. + ### Removed - **Codecov integration** (2026-07-26) — dropped the `main`-only Codecov upload step from the diff --git a/dev-docs/HARNESS_ENGINEERING.md b/dev-docs/HARNESS_ENGINEERING.md index 0cc00694..a4b21479 100644 --- a/dev-docs/HARNESS_ENGINEERING.md +++ b/dev-docs/HARNESS_ENGINEERING.md @@ -66,7 +66,7 @@ Agents working in this repository should be able to answer three questions quick | Shell-script lint (ShellCheck) | `shellcheck-py` pre-commit hook + CI `static-analysis` job | | Type-check helpers | `scripts/type_baseline.sh`, `.basedpyright/README.md` | | Release build | `.github/workflows/release.yml` | -| Dependency and Actions updates | `.github/dependabot.yml` | +| Dependency and Actions updates | `.github/dependabot.yml` (weekly Monday; minor/patch grouped per ecosystem; majors ungrouped) | ## Documentation conventions @@ -458,7 +458,7 @@ Other CI jobs (typecheck, bandit, pip-audit, GUI smoke, package build, doc-fresh | `python scripts/audit_dependencies.py` | Ubuntu `static-analysis` job (requires `.[dev,gui]`) | | SonarCloud CI scan | **Enabled**: `main` is protected by a ruleset and repository variable `SONAR_PROTECTED_MAIN_ENABLED=true`, so `sonar-scan` runs on protected `main` pushes only, after `privacy-gates` + `build`, with combined non-GUI+GUI `coverage.xml`. Automatic Analysis is disabled (CI-based analysis is authoritative). The scan requires the `SONAR_TOKEN` repository secret; no tokenized scanner runs on a PR head. | | `safety scan --detailed-output` | `main` pushes only, in `cloud-scans-main`, after `privacy-gates`, static-analysis, GUI smoke, and the test matrix succeed. Enforced PR coverage is the GHA `coverage-pr` job. | -| PR coverage gate | Ubuntu `coverage-pr` on pull requests after `privacy-gates`: combined non-GUI+GUI `coverage` ≥80% of `src/mypyskindose/*`, plus `diff-cover` ≥80% of lines changed vs the PR base. This is the single coverage standard (80%); the matrix `build` job runs tests only (no coverage gate), and `sonar-scan` enforces ≥80% new-code coverage on `main`. | +| PR coverage gate | Ubuntu `coverage-pr` on pull requests after `privacy-gates`: combined non-GUI+GUI `coverage` ≥80% of `src/mypyskindose/*`, plus `diff-cover` ≥80% of lines changed vs the PR base (base branch fetched with full history so merge-base stays valid when `main` moves). This is the single coverage standard (80%); the matrix `build` job runs tests only (no coverage gate), and `sonar-scan` enforces ≥80% new-code coverage on `main`. | | `python scripts/check_licenses.py` | Ubuntu `static-analysis` job (forbidden licenses; `--check-notices`) | | CodeRabbit | Auto-review off (`.coderabbit.yaml`); path filters exclude sensitive surfaces; `request-coderabbit` job posts `@coderabbitai review` after `privacy-gates` on same-repository PRs (including drafts; deduped per head SHA). The same-repository guard prevents CI from posting comments on fork PRs. Manual CodeRabbit requests bypass the CI ordering, so this is not a trusted privacy boundary. | | pre-commit (local) | `.pre-commit-config.yaml` — commit: ruff, gitleaks, shellcheck, bandit, doc/help checks, backup cleanup; pre-push: basedpyright, semgrep, check-changelog |