From aa17dc891a4eb2e8d760f98c1595d8a2bdf82027 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Thu, 20 Aug 2026 23:53:57 -0700 Subject: [PATCH] Let dependabot maintain the seed workflows too prompts/seed-cli.md copies seed/.github/workflows/* verbatim into every generated CLI, but dependabot only saw the root, so those templates drifted: checkout v6.0.2 and setup-go v6.3.0 against v7.0.1 and v7.0.0 in our own workflows. Every new CLI started on that older set. Adding the path to directories: fixes it at the source rather than by syncing the copies. The docs' 'for GitHub Actions, use the value /' describes the root case; dependabot-core branches on it, and a non-root entry is scanned directly for *.yml -- which is tested upstream with directory: /.github/workflows. Hence the path is the workflows directory itself; /seed alone would scan seed/*.yml and match nothing. Not urgent on its own: the seed also ships .github/dependabot.yml, so a generated project catches up on its first weekly run, and neither lagging pin carries an advisory. This just stops shipping a stale starting point. --- .github/dependabot.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index ee91615..07f7582 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -27,7 +27,13 @@ updates: # GitHub Actions - package-ecosystem: github-actions - directory: "/" + # The seed workflows are copied verbatim into every generated CLI + # (prompts/seed-cli.md), so they need updating like any other workflow. + # For github-actions a non-root entry is scanned directly for *.yml, so the + # path is the workflows directory itself rather than the tree above it. + directories: + - "/" + - "/seed/.github/workflows" schedule: interval: weekly day: monday