From 1a62500cfdf25fc5bb49a4de94565e10c27b9703 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Mon, 7 Sep 2026 09:11:35 -0400 Subject: [PATCH] ci: align the Dependabot ignore for ci-workflows with the fleet decision Widen the ignore back to melodic-software/ci-workflows/* so composites and reusables move together instead of on split cadences. Phase 6b-ii item L (melodic-software/github-iac#378) found that keeping the fleet on one ci-workflows SHA depends on composites moving by hand in the same convergence pass as reusables; narrowing this repo's ignore to only the reusable-workflow path let composite bumps drift onto Dependabot's separate weekly cadence, defeating that one-SHA guarantee. Reusable bumps to an unreviewed SHA still fail the Runner policy contract fleet-wide, so the ignore itself stays; only the glob and its comment change. Co-Authored-By: Claude Fable 5.1 --- .github/dependabot.yml | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f55d252..67b83ce 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -22,11 +22,6 @@ updates: github-actions: patterns: - '*' - # The runner-policy allowlist pins ci-workflows reusable-workflow refs to - # independently reviewed SHAs, so a Dependabot bump to an unreviewed main - # commit can only fail the Runner policy lane. Those pins move through - # deliberate reviewed PRs after a standards allowlist update. Composite - # actions (melodic-software/ci-workflows/.github/actions/*) are not - # SHA-allowlisted and stay Dependabot-managed. + # Reusable bumps to an unreviewed SHA fail the Runner policy contract fleet-wide; composites move by hand in the convergence pass so the fleet stays on one ci-workflows SHA; see melodic-software/github-iac#378 Phase 6b-ii item L. ignore: - - dependency-name: "melodic-software/ci-workflows/.github/workflows/*" + - dependency-name: "melodic-software/ci-workflows/*"