Skip to content

docs(ci): correct the Dependabot PR-budget claim and flag the re-trigger #172

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Sev7eNup merged 1 commit into from
Aug 9, 2026
Merged

docs(ci): correct the Dependabot PR-budget claim and flag the re-trigger #172

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 20 additions & 6 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,26 @@ version: 2
# Central Package Management, so every bump lands in Directory.Packages.props rather than
# in individual csproj files.
#
# PR-budget policy (see CLAUDE.md): at most 5 Dependabot PRs exist at any time — every
# block bundles its minor+patch updates into ONE collective PR and carries
# open-pull-requests-limit: 1, so majors queue behind the collective PR instead of fanning
# out. The first live run in 2026-08 opened 21 individual PRs at once; that noise level is
# deliberately not allowed to repeat. (Note: any edit to this file makes Dependabot
# re-run every block and supersede open singles with the collective PRs.)
# EDITING THIS FILE IMMEDIATELY RE-RUNS EVERY BLOCK. Dependabot does not wait for the
# Monday schedule after a config change: it re-evaluates all five blocks within minutes of
# the merge, opening new collective PRs and superseding open singles. Batch config edits into
# one change instead of merging them one after another — on 2026-08-07 two consecutive
# taming attempts each set off another wave, and on 2026-08-09 two separate Spectre fixes did
# it again. The waves were the config edits, not a Dependabot malfunction.
#
# PR-budget policy (see CLAUDE.md): every block bundles its minor+patch updates into ONE
# collective PR and carries open-pull-requests-limit: 1. That bounds the COLLECTIVE PRs at
# five — one per block — but it is NOT a cap of five overall: the groups below declare
# update-types [minor, patch] only, so every pending MAJOR falls outside them and arrives as
# its own PR. The realistic steady state is "up to five collective PRs plus one per pending
# major" (measured 2026-08-09: four collective + four majors = eight open).
#
# Majors are deliberately left ungrouped. Bundling them would make the number smaller and the
# review worse: the 2026-08-09 grouped NuGet PR carried a Spectre.Console split past a fully
# green CI, and it was only caught by reading the diff. A major deserves its own PR.
#
# The first live run in 2026-08 opened 21 individual PRs at once; that noise level is
# deliberately not allowed to repeat.
updates:
- package-ecosystem: nuget
directory: "/"
Expand Down
3 changes: 2 additions & 1 deletion CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,8 @@ ist nicht nötig. **Immer erst `pg_ctl start`, dann `dotnet run`.**
## Arbeitsweise für Claude

- **Branching:** Nicht-triviale Arbeit auf einem neuen Branch beginnen, **bevor** editiert wird; nachfragen nur, wenn der Branch-Name unklar ist. Triviale Einzeiler (z. B. `.gitignore`) bekommen **keinen** eigenen Branch/PR — in die laufende Arbeit einfalten.
- **PR-Budget: maximal 5 PRs gleichzeitig.** Gilt für eigene Arbeits-Batches (größere Vorhaben in ≤5 PRs schneiden) genauso wie für Dependabot (`.github/dependabot.yml`: Minor/Patch pro Ökosystem in einem Sammel-PR gebündelt, `open-pull-requests-limit: 1` je Block → hartes Gesamtlimit 5; Majors warten hinter dem Sammel-PR).
- **PR-Budget: maximal 5 PRs gleichzeitig** für eigene Arbeits-Batches (größere Vorhaben in ≤5 PRs schneiden). Für **Dependabot gilt diese Zahl nicht**: `.github/dependabot.yml` bündelt Minor/Patch pro Ökosystem in einen Sammel-PR (`open-pull-requests-limit: 1` je Block → max. 5 **Sammel**-PRs), aber die Gruppen deklarieren nur `update-types: [minor, patch]` — jeder offene **Major fällt heraus und bekommt einen eigenen PR**. Realistisch also „bis zu 5 Sammel-PRs plus je einer pro offenem Major" (gemessen 2026-08-09: 4 + 4 = 8). Majors bleiben bewusst ungruppiert, weil ein Bündel den Review verschlechtert — der Spectre-Split kam 2026-08-09 bei grünem CI durch einen Sammel-PR und fiel nur beim Diff-Lesen auf.
- **Jede Änderung an `.github/dependabot.yml` löst sofort alle Blöcke neu aus** (unabhängig vom Montags-Zeitplan) und erzeugt binnen Minuten neue PRs. Config-Edits deshalb **bündeln**, nicht nacheinander mergen.
- **Scope:** Minimaler Root-Cause-Fix. Würde ein Fix deutlich mehr Dateien anfassen als das benannte Problem → stoppen und den geplanten Scope in 3 Bullets nennen, bevor editiert wird.
- **PowerShell 5.1 / Windows:** Kein Inline-SQL durch PowerShell-Quoting — Query in eine `.sql`-Datei schreiben und per `psql -f` ausführen. Dateien als UTF-8 **ohne** BOM schreiben. Keine `sed`/Regex-Zeilen-Edits auf Source-Dateien (CRLF bricht sie) — Edit-Tool verwenden. Kein `$args`-Splatting; explizite benannte Parameter.
- **Reporting:** Knapp berichten — was geändert, was verifiziert, was offen. Keine Per-File-Walkthroughs, kein Plan-Nacherzählen. Interaktive Rückfragen nur, wenn die Antwort wirklich blockiert.
Expand Down
Loading