From 2693b97e3bf11b5bf16517f8690769f568dc422a Mon Sep 17 00:00:00 2001 From: DemchaAV Date: Wed, 5 Aug 2026 14:58:50 +0100 Subject: [PATCH 1/2] docs(ci): record that security updates ignore target-branch MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The comment beside the release-smoke directories said updates for them arrived through the default branch because they sat outside every listed directory, which reads as though listing them stops that happening. It does not. Dependabot raises security updates against the default branch whatever target-branch says, so the next advisory touching one of these manifests will open against `main` again, exactly as #514 did. State the rule instead, name the handling it implies — close the PR and carry the bump to `develop` so the branches stay in a fast-forward line — and note that a non-default target-branch also exempts security updates from the `labels` and `commit-message` settings. --- .github/dependabot.yml | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 140a7612..b1b6cff1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,18 +7,28 @@ updates: - "/" - "/examples" - "/benchmarks" - # The release-smoke consumer projects. They were outside every directory - # listed here, so updates for them arrived through the default branch - # instead — #514 opened against `main`, which is the divergence this - # block's target-branch exists to prevent. They are eight deliberately - # identical projects, so a bump has to reach all of them: grouping them - # under one entry keeps them moving together. + # The release-smoke consumer projects: eight deliberately identical + # setups, so a bump has to reach all of them and one grouped entry keeps + # them moving together. Until they were listed here they had no entry at + # all, which is why nothing but a security alert had ever opened a PR + # for them. - "/scripts/release-smoke/*" - # Send Maven update PRs to the integration branch, not the - # default branch. Releases are cut from `develop` then merged - # to `main`; targeting `main` (the default) made every Dependabot - # PR land alongside the latest release and force-diverge from - # ongoing dev work — fixed in v1.6.8 after the #111 / #115 episodes. + # Send Maven *version* updates to the integration branch, not the default + # branch. Releases are cut from `develop` then merged to `main`; targeting + # `main` (the default) made every Dependabot PR land alongside the latest + # release and force-diverge from ongoing dev work — fixed in v1.6.8 after + # the #111 / #115 episodes. + # + # It does not redirect *security* updates. Those are raised against the + # default branch whatever this says, which is how #514 landed on `main`. + # Listing a directory above does not change that: the next advisory + # touching any of these manifests will open against `main` again. Close it + # and carry the bump to `develop` rather than merging it, so the branches + # stay in a fast-forward line — #517 is the worked example. + # + # Setting a non-default target-branch also exempts security updates from + # the `labels` and `commit-message` settings below, so those PRs arrive + # under Dependabot's defaults and will not match the house style. target-branch: develop schedule: interval: weekly From 13a2475cbb98f58de714827feb8a69e4b20f94b5 Mon Sep 17 00:00:00 2001 From: DemchaAV Date: Wed, 5 Aug 2026 16:12:45 +0100 Subject: [PATCH 2/2] docs(ci): say the eight smoke setups differ, not that they match MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The release-smoke note called them "eight deliberately identical setups". They are not: the eight poms carry eight different coordinate combinations — the wrapper, lean core, core plus each render backend, templates, testing, and the bundle — and s2 additionally runs an enforcer dependency-tree assertion the others do not. Read literally, the sentence invites consolidating them, which would delete the coverage they exist to provide. What is identical is the test scaffolding: junit, assertj and surefire are pinned separately in all eight, which is the actual reason a bump has to be applied eight times. --- .github/dependabot.yml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b1b6cff1..badbe09d 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,11 +7,13 @@ updates: - "/" - "/examples" - "/benchmarks" - # The release-smoke consumer projects: eight deliberately identical - # setups, so a bump has to reach all of them and one grouped entry keeps - # them moving together. Until they were listed here they had no entry at - # all, which is why nothing but a security alert had ever opened a PR - # for them. + # The release-smoke consumer projects: eight deliberately *different* + # setups, one per published coordinate combination, so they must not be + # consolidated. What they share is the test scaffolding — junit, assertj + # and surefire pinned separately in each — which is why a bump has to be + # applied eight times and one grouped entry keeps them moving together. + # Until they were listed here they had no entry at all, which is why + # nothing but a security alert had ever opened a PR for them. - "/scripts/release-smoke/*" # Send Maven *version* updates to the integration branch, not the default # branch. Releases are cut from `develop` then merged to `main`; targeting