From 1c6845ad03c3c52b1d4e592a9913629e48453a20 Mon Sep 17 00:00:00 2001 From: Stephen Brannen Date: Thu, 6 Aug 2026 10:41:15 -0500 Subject: [PATCH 1/2] chore: exempt Dependabot from the version-bump gate and stop tightening squawk-cli - ci.yml: skip the "version differs from main" check for dependabot[bot]. Dependabot edits pyproject.toml (dependency constraints) but never bumps the package version, so its dependency PRs would otherwise always fail the version-consistency gate. - dependabot.yml: ignore squawk-cli so versioning-strategy: increase does not tighten its intentionally broad >=2.0 floor (consumers pin their own via additional_dependencies). Co-Authored-By: Claude Opus 4.8 --- .github/dependabot.yml | 3 +++ .github/workflows/ci.yml | 5 ++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 96f674e..260736c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -22,6 +22,9 @@ updates: ignore: - dependency-name: "*" update-types: ["version-update:semver-major"] + # squawk-cli's >=2.0 floor is intentionally broad so consumers can pin any + # squawk 2.x via additional_dependencies. Do not let Dependabot tighten it. + - dependency-name: "squawk-cli" # GitHub Actions - package-ecosystem: "github-actions" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6789dc8..cabf877 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -64,7 +64,10 @@ jobs: fi echo "Versions match: $PYPROJECT_VERSION" - if [ "${{ github.event_name }}" = "pull_request" ]; then + # Dependabot never bumps the package version, only dependencies, so + # exempt it from the version-bump requirement or its dependency PRs + # (which edit pyproject.toml) would always fail this check. + if [ "${{ github.event_name }}" = "pull_request" ] && [ "${{ github.actor }}" != "dependabot[bot]" ]; then git fetch origin main --depth=1 MAIN_VERSION=$(git show origin/main:pyproject.toml | python -c "import sys, tomllib; print(tomllib.loads(sys.stdin.read())['tool']['poetry']['version'])" || true) if [ -z "$MAIN_VERSION" ]; then From 769aff39a9e14e1b853d509c2760e96bc78f6f8f Mon Sep 17 00:00:00 2001 From: Stephen Brannen Date: Thu, 6 Aug 2026 13:32:44 -0500 Subject: [PATCH 2/2] fix: key the Dependabot version-bump exemption off the PR author github.actor is the user who triggered the current run, so an Update-branch or manual push on a Dependabot PR would set it to a human and wrongly re-enable the version-bump check. Use github.event.pull_request.user.login, which is stable. --- .github/workflows/ci.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cabf877..a0d6135 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -66,8 +66,10 @@ jobs: # Dependabot never bumps the package version, only dependencies, so # exempt it from the version-bump requirement or its dependency PRs - # (which edit pyproject.toml) would always fail this check. - if [ "${{ github.event_name }}" = "pull_request" ] && [ "${{ github.actor }}" != "dependabot[bot]" ]; then + # (which edit pyproject.toml) would always fail this check. Key off the + # PR author, not github.actor: actor becomes the human on an Update-branch + # or manual push, which would wrongly re-enable the check on a bot PR. + if [ "${{ github.event_name }}" = "pull_request" ] && [ "${{ github.event.pull_request.user.login }}" != "dependabot[bot]" ]; then git fetch origin main --depth=1 MAIN_VERSION=$(git show origin/main:pyproject.toml | python -c "import sys, tomllib; print(tomllib.loads(sys.stdin.read())['tool']['poetry']['version'])" || true) if [ -z "$MAIN_VERSION" ]; then