chore(deps): Dependabot does not manage the desktop module, so every shared bump lands red

[devantler]

🤖 Generated by the Daily AI Engineer

Evidence

.github/dependabot.yaml declares package-ecosystem: gomod for directory: / only. The repo has a
second Go module at desktop/, whose go.mod:5 reads:

replace github.com/devantler-tech/ksail/v7 => ../

Because desktop consumes the root module from the local path, the root module's requirements feed
desktop's build list. So the moment Dependabot bumps a shared dependency at /, desktop/go.mod is left
behind and go list -deps ./... in desktop fails with go: updates to go.mod needed; to update it: go mod tidy.

Observed live on #6188 (golang.org/x/crypto 0.53.0 → 0.54.0): four required checks red —
🧪 Test, 📊 Code Coverage, 🏗️ Build (Linux), 🏗️ Build + cask (macOS) — via
TestClaircoreLinkedPackagesStayInert/desktop. Root go.mod had x/crypto v0.54.0; desktop/go.mod still
pinned v0.53.0 // indirect. I unblocked that PR by hand with a go mod tidy in desktop/.

This is structural, not a one-off: every Dependabot bump of a dependency desktop transitively shares
reproduces it, and each one needs a manual tidy before it can go green.

Problem / audience

Maintainers and the automated engineer pay a manual go mod tidy tax on every affected dependency PR, and
each PR sits red in the meantime. desktop/go.mod also carries a comment noting replace directives "must be
duplicated here" — the same lockstep-by-hand class.

Hypothesis

Bringing desktop/ under Dependabot's gomod management (or otherwise keeping the two modules in lockstep)
removes the manual step and keeps these PRs green on arrival.

Design question to settle first

directories: ["/", "/desktop"] makes Dependabot manage both, but by default that yields separate PRs per
directory — which does not by itself give lockstep (the root PR stays red until the desktop PR lands). Options
worth weighing:

• a group spanning both directories, so one PR carries both modules;
• a CI step / test that fails when the two modules' shared pins diverge, making the gap visible at source;
• a small go work-based or scripted tidy in the same PR.

Success signal

A Dependabot bump of a dependency shared with desktop opens green, with no human tidy. Baseline today: 0%
(every such bump needs a manual commit). Guardrail: no increase in duplicate/noisy dependency PRs.

Acceptance criteria

• desktop/ Go module is kept in lockstep with the root module on dependency bumps (mechanism decided above).
• A shared-dependency bump lands with go list -deps ./... green in desktop/ without manual intervention.
• TestClaircoreLinkedPackagesStayInert/desktop passes on such a PR without a follow-up commit.

Rough size: S–M (config + one CI guard).

[coderabbitai]

⚠️ Possible Duplicate Issue(s)

• ci: dependabot gomod bumps blocked by 'Verify Desktop Module Tidy' (desktop/go.mod left stale) #5009

🔗 Related PRs

#5495 - feat(webui): make the AI assistant reachable on web and desktop [closed]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!