ci(deps): keep the NuGet block to options NuGet supports - #100
Merged
Conversation
commit-message.prefix-development and groups.*.dependency-type are documented for bundler, composer, mix, maven, npm and pip -- ecosystems with a production/development split. NuGet has none, so both are rejected, and a rejected key invalidates the whole file rather than the one block. Dependabot went on running the last configuration that parsed, which is why every Dependabot pull request since 2026-08-07 still carries the group names and commit prefixes this file stopped using that day (dotnet-minor-patch, chore(ci)), and why the codeql-action grouping added on 2026-08-24 never grouped anything: init and analyze kept arriving as two pull requests that fail with 'Loaded a configuration file for version X, but running version Y'. versioning-strategy goes with them; it landed in the same commit and NuGet is not among its supported ecosystems either. The production/development split cannot be expressed for NuGet, so the two groups collapse into one minor+patch group, which is what they amounted to.
This was referenced Aug 31, 2026
This was referenced Aug 31, 2026
bgard68
added a commit
that referenced
this pull request
Aug 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's wrong
.github/dependabot.ymlhas not been in effect since 2026-08-07. Dependabot rejects it, falls back to the last configuration that parsed, and reports nothing on the pull requests it goes on opening.The evidence is in the PR titles themselves. Commit
1c7f66b(2026-08-07) renamed the NuGet groupdotnet-minor-patch→dotnet-production/dotnet-developmentand changed the Actions prefixchore(ci)→ci(deps). Every Dependabot PR opened since still uses the old names:chore(deps): Bump the dotnet-minor-patch group…dotnet-productionchore(deps): Bump the dotnet-minor-patch group…dotnet-productionchore(deps): Bump the dotnet-minor-patch group…dotnet-productionchore(deps): Bump the dotnet-minor-patch group…dotnet-productionchore(ci): bump github/codeql-action/init…ci(deps)For contrast, DevSecOpsSentinel's config is applied — its PRs say "in the github-actions group", matching its file. This repo's don't.
Why it matters
The
codeql-actiongroup added on 2026-08-24 (#76) exists precisely to stopinitandanalyzebeing proposed separately, because a split bump fails at run time:That group has never applied. #99 and #95 arrived split again this week and both failed exactly that way — the fourth week running (#34/#35, #47/#48, #69/#72, #95/#99).
The fix
commit-message.prefix-developmentandgroups.*.dependency-typeare documented as "Supported by:bundler,composer,mix,maven,npm, andpip" — ecosystems with a production/development distinction. NuGet has none, so both are invalid there, and one invalid key invalidates the whole file, not just its block.versioning-strategylanded in the same commit and NuGet is not among its supported ecosystems either.versioning-strategy,prefix-development, and the twodependency-typegroups from the NuGet block only.dotnet-production+dotnet-developmentcollapse into onedotnet-version-updatesminor+patch group, which is what they amounted to without the split.dotnet-security, theMicrosoft.OpenApiignore, and thecodeql-action/artifact-actionsgroups are untouched.Verified the result parses and that no unsupported key remains in the NuGet block.
Note
The Dependabot config-error banner (Insights → Dependency graph → Dependabot) names the exact rejected key. Worth checking it after this merges to confirm the file is accepted — if a banner is still shown, something else in here is also rejected.
Once this is in, the next Monday run should produce a single
codeql-actiongroup PR instead of a split pair.