From 5df1f161442e73047c7f8f0566fc074532d7a0d2 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Wed, 11 Nov 2026 02:52:26 +0000 Subject: [PATCH 1/6] [Copilot Dreams] Keep the PR-base rule beside PR creation Repeating the dependency PR target in introductory context creates another copy to maintain without changing the updater's action. The creation step already requires main and supplies --base main; branch setup remains intact. Evidence: https://github.com/github/rust-gems/blob/598b4a16e2eaeff088a7841eaf1d921e25f3ce0c/.github/skills/update-deps/SKILL.md#L211-L216 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/skills/update-deps/SKILL.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/skills/update-deps/SKILL.md b/.github/skills/update-deps/SKILL.md index 807626e2..ec3f4b41 100644 --- a/.github/skills/update-deps/SKILL.md +++ b/.github/skills/update-deps/SKILL.md @@ -10,7 +10,7 @@ Automate the full dependency update lifecycle: discover what's outdated, apply u ## Repository context -This is a Rust workspace containing utility crates published to crates.io. All dependency update PRs target the **`main`** branch. +This is a Rust workspace containing utility crates published to crates.io. Dependabot is configured (`.github/dependabot.yaml`) to open PRs against `main` on the 2nd of each month. This skill gathers individual dependabot PRs, combines updates by ecosystem, fixes any breakage, gets CI green, and creates consolidated PRs for human review. From 5743b3659a874a6751714ad87a292f5d2f34786f Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Wed, 11 Nov 2026 02:52:26 +0000 Subject: [PATCH 2/6] [Copilot Dreams] Keep one dependency-update lifecycle overview A second lifecycle description adds upkeep without a distinct reader action. The imperative overview already names discovery, grouped updates, breakage repair, green CI, and review handoff, and the numbered workflow retains each stage. The separate Dependabot schedule and target statement is unchanged. Evidence: https://github.com/github/rust-gems/blob/598b4a16e2eaeff088a7841eaf1d921e25f3ce0c/.github/skills/update-deps/SKILL.md#L9 Evidence: https://github.com/github/rust-gems/blob/598b4a16e2eaeff088a7841eaf1d921e25f3ce0c/.github/skills/update-deps/SKILL.md#L69-L267 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/skills/update-deps/SKILL.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/skills/update-deps/SKILL.md b/.github/skills/update-deps/SKILL.md index ec3f4b41..60d10052 100644 --- a/.github/skills/update-deps/SKILL.md +++ b/.github/skills/update-deps/SKILL.md @@ -12,7 +12,7 @@ Automate the full dependency update lifecycle: discover what's outdated, apply u This is a Rust workspace containing utility crates published to crates.io. -Dependabot is configured (`.github/dependabot.yaml`) to open PRs against `main` on the 2nd of each month. This skill gathers individual dependabot PRs, combines updates by ecosystem, fixes any breakage, gets CI green, and creates consolidated PRs for human review. +Dependabot is configured (`.github/dependabot.yaml`) to open PRs against `main` on the 2nd of each month. ### Crates in this workspace From 13ccc5be49a9ea6dc581cb8e5b0c36fc698c19d1 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Wed, 11 Nov 2026 02:52:26 +0000 Subject: [PATCH 3/6] [Copilot Dreams] Distinguish ecosystem discovery from update checks Finding dependency files could be mistaken for proving updates are pending. The presence checks establish only which ecosystems exist; the later dependency-intelligence step still finds actual updates. Removing that misleading lead-in leaves both stages and their commands unchanged. Evidence: https://github.com/github/rust-gems/blob/598b4a16e2eaeff088a7841eaf1d921e25f3ce0c/.github/skills/update-deps/SKILL.md#L61-L65 Evidence: https://github.com/github/rust-gems/blob/598b4a16e2eaeff088a7841eaf1d921e25f3ce0c/.github/skills/update-deps/SKILL.md#L69-L100 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/skills/update-deps/SKILL.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/skills/update-deps/SKILL.md b/.github/skills/update-deps/SKILL.md index 60d10052..5066c2b5 100644 --- a/.github/skills/update-deps/SKILL.md +++ b/.github/skills/update-deps/SKILL.md @@ -56,8 +56,6 @@ git fetch origin main git rev-parse --verify origin/main ``` -Detect which ecosystems have pending updates: - ```bash [ -f Cargo.toml ] && echo "cargo" ls .github/workflows/*.yml .github/workflows/*.yaml 2>/dev/null && echo "github-actions" From 441f3f67200a213c5fffc38bf77001ee6bb6f579 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Wed, 11 Nov 2026 02:52:26 +0000 Subject: [PATCH 4/6] [Copilot Dreams] Keep one dependency PR-target mandate Another target-branch rule duplicates the complete PR-creation instruction. The main target survives in step 6 and its command; the removed dev-branch explanation supplies no additional action beyond that target. The separate feature-branch requirement and prohibition on pushing main remain unchanged. Evidence: https://github.com/github/rust-gems/blob/598b4a16e2eaeff088a7841eaf1d921e25f3ce0c/.github/skills/update-deps/SKILL.md#L211-L216 Evidence: https://github.com/github/rust-gems/blob/598b4a16e2eaeff088a7841eaf1d921e25f3ce0c/.github/skills/update-deps/SKILL.md#L272 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/skills/update-deps/SKILL.md | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/skills/update-deps/SKILL.md b/.github/skills/update-deps/SKILL.md index 5066c2b5..06daeb91 100644 --- a/.github/skills/update-deps/SKILL.md +++ b/.github/skills/update-deps/SKILL.md @@ -266,7 +266,6 @@ Report the final PR URL and a summary of what was done. ## Guidelines -- **All PRs target `main`.** There is no separate dev branch. - **Never push to `main` directly.** Always work on a feature branch. - **Never push code that doesn't pass `make lint` and `make test`.** If you can't fix it in 3 tries, stop and ask. - **Be conservative with major version bumps.** If a major version update breaks things and the fix isn't obvious, skip that package and note it in the PR description. From 7cb98612cff2626089898a990d9ca2011f757be8 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Wed, 11 Nov 2026 02:52:26 +0000 Subject: [PATCH 5/6] [Copilot Dreams] Keep Cargo working-directory guidance with its recipe Repeating the workspace recipe in edge cases creates a second maintenance point without a distinct trigger or action. The earlier cargo update/check recipe already requires the repository root and explains per-crate manifests and the single root lockfile. Those requirements remain unchanged. Evidence: https://github.com/github/rust-gems/blob/598b4a16e2eaeff088a7841eaf1d921e25f3ce0c/.github/skills/update-deps/SKILL.md#L122-L130 Evidence: https://github.com/github/rust-gems/blob/598b4a16e2eaeff088a7841eaf1d921e25f3ce0c/Cargo.toml#L1-L11 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/skills/update-deps/SKILL.md | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/skills/update-deps/SKILL.md b/.github/skills/update-deps/SKILL.md index 06daeb91..1f1b3b65 100644 --- a/.github/skills/update-deps/SKILL.md +++ b/.github/skills/update-deps/SKILL.md @@ -277,7 +277,6 @@ Report the final PR URL and a summary of what was done. ## Edge cases -- **Cargo workspace:** Dependencies are declared per-crate but share a single `Cargo.lock` at the workspace root. Always run `cargo update` and `cargo check` from the repo root. - **npm:** Look for `package.json` files to discover npm packages rather than hardcoding paths — the repo layout may change. - **WASM builds:** After updating `wasm-bindgen` or related deps, verify `make build-js` still works — WASM toolchain version mismatches are common. - **Rate limits:** If `gh api` hits rate limits, wait and retry. Report to user if persistent. From c17e660f373dd03a7c5b9fa09030df4c6a68dbb2 Mon Sep 17 00:00:00 2001 From: Copilot <223556219+Copilot@users.noreply.github.com> Date: Wed, 11 Nov 2026 02:52:27 +0000 Subject: [PATCH 6/6] [Copilot Dreams] Keep one no-updates decision rule Repeating what to do for an unchanged ecosystem adds upkeep without a different reader action. The guideline already requires skipping it and telling the user, and the neighboring rule retains serial ecosystem work. The removed optional exit introduces no extra duty when the work is finished. Evidence: https://github.com/github/rust-gems/blob/598b4a16e2eaeff088a7841eaf1d921e25f3ce0c/.github/skills/update-deps/SKILL.md#L276-L277 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/skills/update-deps/SKILL.md | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/skills/update-deps/SKILL.md b/.github/skills/update-deps/SKILL.md index 1f1b3b65..368a37f2 100644 --- a/.github/skills/update-deps/SKILL.md +++ b/.github/skills/update-deps/SKILL.md @@ -280,6 +280,5 @@ Report the final PR URL and a summary of what was done. - **npm:** Look for `package.json` files to discover npm packages rather than hardcoding paths — the repo layout may change. - **WASM builds:** After updating `wasm-bindgen` or related deps, verify `make build-js` still works — WASM toolchain version mismatches are common. - **Rate limits:** If `gh api` hits rate limits, wait and retry. Report to user if persistent. -- **Nothing to update:** Report cleanly and move to the next ecosystem (or exit). - **Merge conflicts on push:** Rebase on `main` and retry: `git fetch origin main && git rebase origin/main`. - **Branch already exists:** If `deps/{ecosystem}-updates-{date}` already exists, append a counter or ask user.