chore: Revert "chore(dependabot): merge 2 groups" #5975
Conversation
This reverts commit f36b851.
WalkthroughThe pull request modifies the Changes
Poem
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🔭 Outside diff range comments (1)
.github/dependabot.yml (1)
Remove ProjectDiscovery exclusion from security updates
The verification confirms that excluding ProjectDiscovery dependencies from security updates is risky. The codebase heavily relies on ProjectDiscovery's security-critical packages including authentication providers, cryptographic utilities, and network security components. As this is a security-focused tool, all dependencies should receive timely security updates.
🔗 Analysis chain
Line range hint
29-33: Review security update strategyThe current configuration excludes ProjectDiscovery dependencies from security updates. This could potentially delay critical security patches for these dependencies.
Consider this alternative structure:
- package-ecosystem: "gomod" directory: "/" schedule: interval: "weekly" target-branch: "dev" commit-message: prefix: "chore" include: "scope" groups: all-deps: patterns: ["*"] security: applies-to: "security-updates" patterns: ["*"] labels: - "Type: Maintenance"🏁 Scripts executed
The following scripts were executed for the analysis:
Error: No shell scripts found
Script:
#!/bin/bash # Check for ProjectDiscovery dependencies in go.mod echo "=== ProjectDiscovery Dependencies ===" rg "github.com/projectdiscovery" go.mod -A 1 # Look for imports of ProjectDiscovery security-related packages echo -e "\n=== ProjectDiscovery Security-Related Imports ===" rg "\"github.com/projectdiscovery.*security.*\"" -g "*.go" rg "\"github.com/projectdiscovery.*crypto.*\"" -g "*.go" rg "\"github.com/projectdiscovery.*auth.*\"" -g "*.go"Length of output: 3852
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/dependabot.yml(1 hunks)
🔇 Additional comments (2)
.github/dependabot.yml (2)
11-17: Reconsider the dependency grouping strategyThe current configuration might not achieve the desired PR grouping behavior. Having separate
allowrules while also trying to group dependencies could lead to individual PRs being created instead of grouped ones.Consider consolidating the dependency management strategy into a single gomod configuration block with clear grouping rules.
Line range hint
1-65: Verify if this achieves the intended revertBased on the PR objective to revert changes that caused individual PRs instead of grouping them, this configuration might not achieve the desired outcome. The current changes introduce complex allow/ignore patterns and duplicate configurations that could potentially cause more issues with PR grouping.
Run this script to compare with the previous working version:
| - package-ecosystem: "gomod" | ||
| directory: "/" | ||
| schedule: | ||
| interval: "weekly" | ||
| target-branch: "dev" | ||
| commit-message: | ||
| prefix: "chore" | ||
| include: "scope" | ||
| ignore: | ||
| - dependency-name: "github.com/projectdiscovery/*" | ||
| groups: |
There was a problem hiding this comment.
Remove duplicate and conflicting gomod configuration
The second gomod configuration block creates conflicting rules with the first block:
- Both target the same directory "/"
- First block allows ProjectDiscovery dependencies while this block ignores them
- This could lead to unpredictable behavior in dependency updates
Consider merging both configurations into a single gomod block with clear, non-conflicting rules.
Proposed changes
This reverts commit f36b851.
^ strange that this is creating PRs individually instead of grouping them.
Checklist
Summary by CodeRabbit