Skip to content

Move Dependabot day to Wednesday and ignore major upgrades#418

Open
amishas157 wants to merge 1 commit intomasterfrom
dependabot-config-update
Open

Move Dependabot day to Wednesday and ignore major upgrades#418
amishas157 wants to merge 1 commit intomasterfrom
dependabot-config-update

Conversation

@amishas157
Copy link
Copy Markdown
Contributor

Summary

Two small changes to .github/dependabot.yml:

  1. Schedule day moved sunday → wednesday so Dependabot PRs land mid-week and aren't sitting through the weekend.
  2. Major-version upgrades ignored via ignore: [{dependency-name: "*", update-types: [version-update:semver-major]}] on every updates entry. Major bumps were repeatedly creating PRs that couldn't pass CI due to transitive constraints (e.g. apache-airflow-providers-cncf-kubernetes 10.16.1 requiring cryptography ≥44 vs gcloud-aio-auth capping at <42; click 8.3.x capped by sqlfluff 3.5.0). Major upgrades will be done manually when the surrounding deps can absorb them.

For the dbt/airflow repos that previously had a separate major group entry, that group is now redundant and removed.

Test plan

  • Verify YAML is valid (Dependabot will surface a config error in the repo's Insights → Dependency graph → Dependabot tab if not).

- schedule.day: sunday -> wednesday across all updates entries
- Add ignore rule (update-types: ["version-update:semver-major"]) so
  Dependabot stops opening major-version PRs that historically failed CI
  due to transitive constraints.
@amishas157 amishas157 requested a review from a team as a code owner April 30, 2026 20:53
Copilot AI review requested due to automatic review settings April 30, 2026 20:53
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the repository’s Dependabot configuration to better align dependency update timing with the work week and to reduce CI-noisy PRs caused by major-version bumps that frequently fail due to transitive constraints.

Changes:

  • Moved the weekly Dependabot schedule from Sunday to Wednesday (02:00) for all configured ecosystems.
  • Added a global ignore rule to suppress semver-major updates for all dependencies across all ecosystems.
  • Kept existing grouping behavior for Go modules, GitHub Actions, and Docker updates.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants