Repository navigation
Conversation
parlough
commented
Oct 24, 2026
parlough
commented
- Consolidate pub ecosystem entries per codelab and group updates by dependency name.
- Add seven-day cooldowns to appease zizmor checks.
- Remove the stale pip entry and unused beta flag.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the .github/dependabot.yaml configuration to consolidate dependency management across multiple codelab steps. However, the review identified several critical configuration errors: the cooldown option is invalid, the group-by key is not supported within the groups configuration, and the use of wildcard paths in directories is not supported by Dependabot, requiring explicit path definitions.
| interval: "daily" | ||
| # Don't auto-submit github action updates until subosito/flutter-action update is cleared | ||
| cooldown: | ||
| default-days: 7 |
There was a problem hiding this comment.
The cooldown option is not a valid configuration key in GitHub Dependabot. Including it will cause Dependabot to fail parsing this configuration file entirely, preventing any updates from running.
If you want to reduce the frequency of updates, you can change the schedule.interval to weekly or monthly instead of daily. Please remove this block here and from all other ecosystem entries in this file.
interval: "daily"There was a problem hiding this comment.
Looks like Gemini doesn't like this flag. Thoughts?
| labels: | ||
| - "autosubmit" | ||
| groups: | ||
| animated-responsive-layout: | ||
| group-by: "dependency-name" |
There was a problem hiding this comment.
The group-by key is not a valid option under Dependabot's groups configuration. Using it will cause a schema validation error, and Dependabot will fail to run.
Depending on your intent, you have two options:
- If you want one PR per dependency across all directories (e.g., one PR updating
provideracross all steps): You can remove thegroupsblock entirely. Dependabot automatically groups updates of the same dependency across directories specified indirectoriesby default. - If you want to group all dependency updates for a specific codelab into a single PR (e.g., one PR for all updates in
animated-responsive-layout): Usepatterns: ["*"]instead.
labels:
- "autosubmit"| directories: | ||
| - "/in_app_purchases/*/app" | ||
| - "/in_app_purchases/*/dart-backend" |
There was a problem hiding this comment.
Dependabot's wildcard support for directories is limited to trailing wildcards (e.g., /directory/*). It does not support wildcards in the middle of a path like /in_app_purchases/*/app or recursive globbing (**).
As a result, Dependabot will not be able to locate the pubspec.yaml files in these subdirectories. You should list these directories explicitly.
- "/in_app_purchases/complete/app"
- "/in_app_purchases/complete/dart-backend"
- "/in_app_purchases/step_00/app"
- "/in_app_purchases/step_00/dart-backend"
- "/in_app_purchases/step_03/app"
- "/in_app_purchases/step_03/dart-backend"
- "/in_app_purchases/step_07/app"
- "/in_app_purchases/step_07/dart-backend"
- "/in_app_purchases/step_08/app"
- "/in_app_purchases/step_08/dart-backend"
- "/in_app_purchases/step_10/app"
- "/in_app_purchases/step_10/dart-backend"
- "/in_app_purchases/step_11/app"
- "/in_app_purchases/step_11/dart-backend"
domesticmouse
left a comment
domesticmouse
left a comment
There was a problem hiding this comment.
Looks like Gemini has thoughts. I don't have access to what the truth with dependabot's schema actually is.
