From 8564cabebc3805e026995f415199949b0e1298db Mon Sep 17 00:00:00 2001 From: Hug0-Drelon Date: Tue, 1 Sep 2026 17:26:06 +0200 Subject: [PATCH 1/4] chore(ci): add Dependabot and reviewer workflow Weekly npm updates for production and peer dependencies only; request review and changelog reminder on production bumps. --- .github/dependabot.yml | 33 ++++++++++++++++++++++ .github/workflows/dependabot-reviewer.yml | 34 +++++++++++++++++++++++ 2 files changed, 67 insertions(+) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/dependabot-reviewer.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..2281de6 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,33 @@ +# Same schedule across Polylang plugins; Dependabot does not sync versions between repos. +# allow — if a package does not match, Dependabot does not open a version PR or a security PR for it. +# groups.peer-deps — among packages that already passed allow, matching ones are collapsed into one PR instead of many. +version: 2 +updates: + - package-ecosystem: npm + directory: / + schedule: + interval: weekly + day: monday + time: "07:00" + timezone: Europe/Paris + allow: + - dependency-type: production + - dependency-name: clean-webpack-plugin + - dependency-name: copy-webpack-plugin + - dependency-name: css-minimizer-webpack-plugin + - dependency-name: glob + - dependency-name: mini-css-extract-plugin + - dependency-name: sass-loader + - dependency-name: terser-webpack-plugin + - dependency-name: webpack + groups: + peer-deps: + patterns: + - clean-webpack-plugin + - copy-webpack-plugin + - css-minimizer-webpack-plugin + - glob + - mini-css-extract-plugin + - sass-loader + - terser-webpack-plugin + - webpack diff --git a/.github/workflows/dependabot-reviewer.yml b/.github/workflows/dependabot-reviewer.yml new file mode 100644 index 0000000..e0b1115 --- /dev/null +++ b/.github/workflows/dependabot-reviewer.yml @@ -0,0 +1,34 @@ +name: Request Dependabot review + +on: + pull_request: + types: [opened] + +permissions: + contents: read + pull-requests: write + +jobs: + request-review: + if: github.event.pull_request.user.login == 'dependabot[bot]' + runs-on: ubuntu-latest + steps: + - name: Request review + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_REPO: ${{ github.repository }} + run: gh pr edit "${{ github.event.pull_request.number }}" --add-reviewer Hug0-Drelon + + - name: Dependabot metadata + id: metadata + uses: dependabot/fetch-metadata@v3 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + + - name: Comment on production updates + if: steps.metadata.outputs.dependency-type == 'direct:production' + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GH_REPO: ${{ github.repository }} + DEP_NAMES: ${{ steps.metadata.outputs.dependency-names }} + run: gh pr comment "${{ github.event.pull_request.number }}" --body "This Dependabot PR updates a production dependency (\`${DEP_NAMES}\`). Update the changelog for the next release before merging." From 60d56670006edef2e55f1bfb3a622dc2d4606075 Mon Sep 17 00:00:00 2001 From: Hug0-Drelon Date: Tue, 1 Sep 2026 17:27:50 +0200 Subject: [PATCH 2/4] chore(ci): drop Dependabot reviewer workflow Repo activity notifications are enough; no auto review request or comment. --- .github/workflows/dependabot-reviewer.yml | 34 ----------------------- 1 file changed, 34 deletions(-) delete mode 100644 .github/workflows/dependabot-reviewer.yml diff --git a/.github/workflows/dependabot-reviewer.yml b/.github/workflows/dependabot-reviewer.yml deleted file mode 100644 index e0b1115..0000000 --- a/.github/workflows/dependabot-reviewer.yml +++ /dev/null @@ -1,34 +0,0 @@ -name: Request Dependabot review - -on: - pull_request: - types: [opened] - -permissions: - contents: read - pull-requests: write - -jobs: - request-review: - if: github.event.pull_request.user.login == 'dependabot[bot]' - runs-on: ubuntu-latest - steps: - - name: Request review - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GH_REPO: ${{ github.repository }} - run: gh pr edit "${{ github.event.pull_request.number }}" --add-reviewer Hug0-Drelon - - - name: Dependabot metadata - id: metadata - uses: dependabot/fetch-metadata@v3 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - - - name: Comment on production updates - if: steps.metadata.outputs.dependency-type == 'direct:production' - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GH_REPO: ${{ github.repository }} - DEP_NAMES: ${{ steps.metadata.outputs.dependency-names }} - run: gh pr comment "${{ github.event.pull_request.number }}" --body "This Dependabot PR updates a production dependency (\`${DEP_NAMES}\`). Update the changelog for the next release before merging." From ffc331ba9885e2f280a4bcfc7fe2fe439ee19552 Mon Sep 17 00:00:00 2001 From: Hug0-Drelon Date: Tue, 1 Sep 2026 17:41:12 +0200 Subject: [PATCH 3/4] chore(ci): drop peer dependency allow rules from Dependabot Dependabot does not open version PRs for peerDependencies. --- .github/dependabot.yml | 21 +-------------------- 1 file changed, 1 insertion(+), 20 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 2281de6..6e238f0 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,6 +1,6 @@ # Same schedule across Polylang plugins; Dependabot does not sync versions between repos. # allow — if a package does not match, Dependabot does not open a version PR or a security PR for it. -# groups.peer-deps — among packages that already passed allow, matching ones are collapsed into one PR instead of many. +# Dependabot does not version-bump peerDependencies; only dependencies are covered here. version: 2 updates: - package-ecosystem: npm @@ -12,22 +12,3 @@ updates: timezone: Europe/Paris allow: - dependency-type: production - - dependency-name: clean-webpack-plugin - - dependency-name: copy-webpack-plugin - - dependency-name: css-minimizer-webpack-plugin - - dependency-name: glob - - dependency-name: mini-css-extract-plugin - - dependency-name: sass-loader - - dependency-name: terser-webpack-plugin - - dependency-name: webpack - groups: - peer-deps: - patterns: - - clean-webpack-plugin - - copy-webpack-plugin - - css-minimizer-webpack-plugin - - glob - - mini-css-extract-plugin - - sass-loader - - terser-webpack-plugin - - webpack From c60c83bf562b7c811329170dfc0b5a8b8755426c Mon Sep 17 00:00:00 2001 From: Hug0-Drelon Date: Wed, 2 Sep 2026 11:05:16 +0200 Subject: [PATCH 4/4] chore(ci): allow Dependabot minor/patch bumps for devDependencies Lint and test tooling should stay current; major upgrades stay manual. --- .github/dependabot.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6e238f0..297f656 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -12,3 +12,15 @@ updates: timezone: Europe/Paris allow: - dependency-type: production + - dependency-type: development + update-types: + - version-update:semver-minor + - version-update:semver-patch + groups: + dev-tools: + patterns: + - "@wordpress/eslint-plugin" + - "@wordpress/prettier-config" + - eslint + - jest + - prettier