deps: group lockstep dependency families in dependabot - #2583
Merged
Quang Nguyen (nddq) merged 1 commit intoJul 27, 2026
Conversation
Dependabot splits families that must move together into separate PRs,
each of which is unmergeable on its own.
github/codeql-action/{init,autobuild,analyze} are pinned to one SHA;
bumping one leaves the workflow on mixed versions, which CodeQL rejects.
Group them. actions-patch declares no patterns, so it scores
NO_PATTERNS_SCORE (500) in Dependabot's pattern-specificity calculator
and out-ranks the codeql-action group (106) regardless of ordering;
excluding codeql-action from actions-patch removes it from that contest.
helm.sh/helm/v3 and cloud-provider-azure's configloader transitively pin
k8s.io/client-go, so they must move with the k8s group. cilium
hive/statedb/stream are pinned by cilium/cilium's own go.mod and cannot
move independently; ignore them so they follow cilium/cilium via MVS.
Signed-off-by: Quang Nguyen <nguyenquang@microsoft.com>
Quang Nguyen (nddq)
requested review from
Alexander (QxBytes) and
Ritwik Ranjan (ritwikranjan)
July 27, 2026 15:02
Retina Code Coverage ReportTotal coverage no changeDecreased diff
|
Quang Nguyen (nddq)
enabled auto-merge
July 27, 2026 15:13
ibezrukavyi
approved these changes
Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Dependabot splits three dependency families that must move together, so each PR is unmergeable on its own.
codeql-action —
codeql.yamlpinsinit,autobuildandanalyzeto one SHA, and CodeQL rejects mixed versions.actions-patchcoverspatchonly, so minor bumps get one PR per sub-action and everyAnalyzejob fails:That is #2573, #2574 and #2575.
k8s —
helm.sh/helm/v3is in no group but pinsk8s.io/client-gotransitively (v3.21.3needsv0.36.2,controller-runtime v0.23.3needsv0.35.0). Bumping helm alone fails onhandlerRegistration does not implement cache.ResourceEventHandlerRegistration (missing method HasSyncedChecker), so #2544 and #2324 are two halves of one change.cilium —
cilium/cilium v1.19.3pinshive,statedbandstreamto exactly retina's versions; moving them alone breaks cilium's own source (#2543, #2520).Changes
github/codeql-action*, covering all four sub-actions incodeql.yamlandtrivy.yaml.actions-patchgets a matchingexclude-patterns: with nopatternsof its own it scores 500 against the new group's 106, so it would otherwise claim these and then drop them for not beingpatch.helm.sh/helm/v3and the exact pathsigs.k8s.io/cloud-provider-azure/pkg/azclient/configloader, which pins client-go the same way. An exact path scores 1000, outrankingazure-sdk. The exclusion narrows topkg/azclient, which has no client-go dependency.hive,statedbandstream. MVS still raises them whencilium/ciliummoves.minor;1.43.0→1.44.0arrived as three PRs (deps: bump go.opentelemetry.io/otel/trace from 1.43.0 to 1.44.0 #2408, deps: bump go.opentelemetry.io/otel/metric from 1.43.0 to 1.44.0 #2409, deps: bump go.opentelemetry.io/otel from 1.43.0 to 1.44.0 #2410).Related Issue
N/A.
Checklist
git commit -S -s ...). See this documentation on signing commits.Screenshots (if applicable) or Testing Completed
Local run against the real updater image:
mainproduces three ungrouped codeql PRs, this config produces one holding all four. Droppingexclude-patternsreproducesmainexactly.Hosted Dependabot on a fork:
v4.37.33.21.1→3.21.3, controller-runtime0.23.3→0.24.1,k8s.io/*→0.36.2cilium/ciliumv1.19.3→v1.19.6withebpf v0.22.0andstatedb v0.5.9, asv1.19.6requiresSchema-validates against
dependabot-2.0.jsonwith no new errors versusmain.Additional Notes
configloaderstays put until the k8s group lands: its bump raisesk8s.io/apito0.36.xwhilekubectlstays at0.35.3, whosepkg/schemeimportsk8s.io/api/scheduling/v1alpha1, removed in0.36.go mod tidyfails with it alone and passes with the full set, so no extra config is needed.Once this lands, #2573, #2574, #2575, #2544, #2324, #2543 and #2520 can be closed.