From e25a0bc5cd53a3bee117fabf942cad48b0078176 Mon Sep 17 00:00:00 2001 From: Pavlo Strunkin Date: Tue, 3 Nov 2026 08:17:58 +0200 Subject: [PATCH] ci: let Dependabot see the release tooling versions semantic-release and the conventionalcommits preset were pinned in an `npx -p` line, which Dependabot does not read. They now live in .github/release/package.json with their own Dependabot entry; the preset's majors stay ignored while semantic-release 25 cannot render 10. That manifest has no lockfile on purpose: semantic-release's bundled npm ships glob, minimatch, undici and ip-address versions with advisories, and overrides do not reach bundled packages. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 13 +++++++++++++ .github/release/package.json | 7 +++++++ .github/workflows/release.yml | 6 ++++-- 3 files changed, 24 insertions(+), 2 deletions(-) create mode 100644 .github/release/package.json diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 64b77d4..ec1d117 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -28,6 +28,19 @@ updates: patterns: - "*" + - package-ecosystem: npm + directory: "/.github/release" + schedule: + interval: weekly + ignore: + # semantic-release 25 cannot render conventional-changelog-conventionalcommits 10 + - dependency-name: "conventional-changelog-conventionalcommits" + update-types: ["version-update:semver-major"] + groups: + release-tooling: + patterns: + - "*" + - package-ecosystem: github-actions directory: "/" schedule: diff --git a/.github/release/package.json b/.github/release/package.json new file mode 100644 index 0000000..b0c372a --- /dev/null +++ b/.github/release/package.json @@ -0,0 +1,7 @@ +{ + "private": true, + "devDependencies": { + "conventional-changelog-conventionalcommits": "9.3.1", + "semantic-release": "25.0.9" + } +} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 465ca8a..2c26293 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -36,5 +36,7 @@ jobs: - name: Release env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # semantic-release 25 cannot render conventional-changelog-conventionalcommits 10 - run: npx -p semantic-release@25.0.9 -p conventional-changelog-conventionalcommits@9.3.1 semantic-release + # own manifest without a lockfile: the npm bundled in semantic-release has advisories no override can reach + run: | + npm install --prefix .github/release --no-package-lock --no-audit --no-fund + .github/release/node_modules/.bin/semantic-release