chore(dependabot): cap open pull requests per update block by hyperpolymath · Pull Request #102 · hyperpolymath/accessibility-everywhere

hyperpolymath · 2026-09-12T14:15:08Z

Adds open-pull-requests-limit to Dependabot update blocks that had no cap, following the estate per-ecosystem cap doctrine (task #37). No other line in the file is touched.

Claude-Session: https://claude.ai/code/session_011eQ7hibx92N7fBDtwgReWk

Summary

Closes #

Type of change

🐛 Bug fix (non-breaking change that fixes an issue)
✨ New feature (non-breaking change that adds functionality)
💥 Breaking change (would change existing behaviour)
🕳️ Soundness fix (fixes a checker/proof false-negative)
📖 Documentation
🧹 Refactor / tech debt (behaviour-preserving)
⚡ Performance
🔧 Build / CI / tooling

How has this been verified?

Checklist

My commits are signed (git commit -S).
I ran the project's own checks/tests locally and they pass.
New files carry the correct SPDX-License-Identifier (code/config MPL-2.0,
prose CC-BY-SA-4.0); I did not relicense existing files.
Docs are updated, and no public claim now overstates what the code does.
I have not introduced a soundness hole (or I have flagged where I might have).

Notes for reviewers

Adds `open-pull-requests-limit` to Dependabot update blocks that had no cap, following the estate per-ecosystem cap doctrine (task #37). No other line in the file is touched. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011eQ7hibx92N7fBDtwgReWk

coderabbitai · 2026-09-12T14:15:25Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: f7dff08a-65ee-41d9-832d-4d1afec0626b

📥 Commits

Reviewing files that changed from the base of the PR and between 8a08299 and b9bce90.

📒 Files selected for processing (1)

.github/dependabot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (6)

GitHub Check: CI Summary
GitHub Check: governance / Security policy checks
GitHub Check: scan / Hypatia Neurosymbolic Analysis
GitHub Check: analyze (javascript-typescript, none)
GitHub Check: build
GitHub Check: GitGuardian Security Checks

⚠️ CI failures not shown inline (6)

GitHub Actions: Secret Scanner / 0_scan _ shell-secrets.txt: chore(dependabot): cap open pull requests per update block

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
 �[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
 �[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
 �[36;1m# immediately preceding line.�[0m
 �[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
 �[36;1m�[0m
 �[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
 �[36;1m# reference rather than a literal are never real secrets.�[0m
 �[36;1m# Matches: ="$VAR"  ="${VAR}"  ="${VAR:-…}"  ="${VAR:?…}"  ='${VAR}'  =$VAR�[0m
 �[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
 �[36;1m�[0m
 �[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
 �[36;1mIGNORE_GLOBS=()�[0m
 �[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
 �[36;1m  while IFS= read -r line || [[ -n "$line" ]]; do�[0m
 �[36;1m    # Skip blank lines and comments�[0m
 �[36;1m    [[ -z "$line" || "$line" == \#* ]] && continue�[0m
 �[36;1m    IGNORE_GLOBS+=("$line")�[0m
 �[36;1m  done < .shell-secrets-ignore�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
 �[36;1mis_ignored() {�[0m
 �[36;1m  local path="$1"�[0m
 �[36;1m  for glob in "${IGNORE_GLOBS[@]}"; do�[0m
 �[36;1m    #...

GitHub Actions: Secret Scanner / scan _ shell-secrets: chore(dependabot): cap open pull requests per update block

Conclusion: failure

View job details

##[group]Run # Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.
 �[36;1m# Patterns: an `export FOO=` or `FOO=` with a quoted literal of meaningful length.�[0m
 �[36;1m# Restricted to *_TOKEN / *_KEY / *_SECRET / PASSWORD to keep false-positives low.�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*TOKEN[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*API_KEY[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{20,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?[A-Z_]*SECRET[A-Z_]*=["'"'"'][A-Za-z0-9_./+=-]{16,}["'"'"']'�[0m
 �[36;1m  '(export[[:space:]]+)?***"'"'"'][^"'"'"']{6,}["'"'"']'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1m# Inline pragma patterns — suppress a hit when found on the same or�[0m
 �[36;1m# immediately preceding line.�[0m
 �[36;1mPRAGMA_RE='(scanner-allow:[[:space:]]*shell-secrets|hypatia:[[:space:]]*allow[[:space:]]+security_errors/secret_detected)'�[0m
 �[36;1m�[0m
 �[36;1m# Param-expansion RHS pattern — assignments whose value is a variable�[0m
 �[36;1m# reference rather than a literal are never real secrets.�[0m
 �[36;1m# Matches: ="$VAR"  ="${VAR}"  ="${VAR:-…}"  ="${VAR:?…}"  ='${VAR}'  =$VAR�[0m
 �[36;1mPARAM_EXPANSION_RE='=['"'"'"'"'"']?\$\{?[A-Za-z_][A-Za-z0-9_]*(:[?-][^}]*)?\}?['"'"'"'"'"']?[[:space:]]*(#.*)?$'�[0m
 �[36;1m�[0m
 �[36;1m# Load per-repo ignore globs from .shell-secrets-ignore if present.�[0m
 �[36;1mIGNORE_GLOBS=()�[0m
 �[36;1mif [[ -f .shell-secrets-ignore ]]; then�[0m
 �[36;1m  while IFS= read -r line || [[ -n "$line" ]]; do�[0m
 �[36;1m    # Skip blank lines and comments�[0m
 �[36;1m    [[ -z "$line" || "$line" == \#* ]] && continue�[0m
 �[36;1m    IGNORE_GLOBS+=("$line")�[0m
 �[36;1m  done < .shell-secrets-ignore�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1m# is_ignored <filepath> — returns 0 (true) if path matches any ignore glob.�[0m
 �[36;1mis_ignored() {�[0m
 �[36;1m  local path="$1"�[0m
 �[36;1m  for glob in "${IGNORE_GLOBS[@]}"; do�[0m
 �[36;1m    #...

GitHub Actions: Secret Scanner / 1_scan _ rust-secrets.txt: chore(dependabot): cap open pull requests per update block

Conclusion: failure

View job details

##[group]Run if ! find . -name Cargo.toml -not -path './target/*' -print -quit | grep -q .; then
 �[36;1mif ! find . -name Cargo.toml -not -path './target/*' -print -quit | grep -q .; then�[0m
 �[36;1m  echo 'No Cargo.toml found — skipping Rust secrets check'�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  'const.*SECRET.*=.*"'�[0m
 �[36;1m  'const.*KEY.*=.*"[a-zA-Z0-9]{16,}"'�[0m
 �[36;1m  'const.*TOKEN.*=.*"'�[0m
 �[36;1m  'let.*api_key.*=.*"'�[0m
 �[36;1m  'HMAC.*"[a-fA-F0-9]{32,}"'�[0m
 �[36;1m  'password.*=.*"[^"]+"'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1mfound=0�[0m
 �[36;1mfor pattern in "${PATTERNS[@]}"; do�[0m
 �[36;1m  if grep -rn --include="*.rs" -E "$pattern" src/; then�[0m
 �[36;1m    echo "WARNING: Potential hardcoded secret found matching: $pattern"�[0m
 �[36;1m    found=1�[0m
 �[36;1m  fi�[0m
 �[36;1mdone�[0m
 �[36;1m�[0m
 �[36;1mif [ $found -eq 1 ]; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets detected. Use environment variables instead."�[0m

GitHub Actions: Secret Scanner / scan _ rust-secrets: chore(dependabot): cap open pull requests per update block

Conclusion: failure

View job details

##[group]Run if ! find . -name Cargo.toml -not -path './target/*' -print -quit | grep -q .; then
 �[36;1mif ! find . -name Cargo.toml -not -path './target/*' -print -quit | grep -q .; then�[0m
 �[36;1m  echo 'No Cargo.toml found — skipping Rust secrets check'�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mPATTERNS=(�[0m
 �[36;1m  'const.*SECRET.*=.*"'�[0m
 �[36;1m  'const.*KEY.*=.*"[a-zA-Z0-9]{16,}"'�[0m
 �[36;1m  'const.*TOKEN.*=.*"'�[0m
 �[36;1m  'let.*api_key.*=.*"'�[0m
 �[36;1m  'HMAC.*"[a-fA-F0-9]{32,}"'�[0m
 �[36;1m  'password.*=.*"[^"]+"'�[0m
 �[36;1m)�[0m
 �[36;1m�[0m
 �[36;1mfound=0�[0m
 �[36;1mfor pattern in "${PATTERNS[@]}"; do�[0m
 �[36;1m  if grep -rn --include="*.rs" -E "$pattern" src/; then�[0m
 �[36;1m    echo "WARNING: Potential hardcoded secret found matching: $pattern"�[0m
 �[36;1m    found=1�[0m
 �[36;1m  fi�[0m
 �[36;1mdone�[0m
 �[36;1m�[0m
 �[36;1mif [ $found -eq 1 ]; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets detected. Use environment variables instead."�[0m

GitHub Actions: Secret Scanner / 3_trufflehog.txt: chore(dependabot): cap open pull requests per update block

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]The action trufflesecurity/trufflehog@main is not allowed in hyperpolymath/accessibility-everywhere because all actions must be pinned to a full-length commit SHA.

GitHub Actions: Secret Scanner / trufflehog: chore(dependabot): cap open pull requests per update block

Conclusion: failure

View job details

##[group]GITHUB_TOKEN Permissions
 Contents: read
 Metadata: read
 ##[endgroup]
 Secret source: Actions
 Cache mode: write
 Prepare workflow directory
 Prepare all required actions
 Getting action download info
 ##[error]The action trufflesecurity/trufflehog@main is not allowed in hyperpolymath/accessibility-everywhere because all actions must be pinned to a full-length commit SHA.

🔇 Additional comments (1)

.github/dependabot.yml (1)

16-16: LGTM!

Also applies to: 25-25

📝 Summary

Summary by CodeRabbit

Chores
- Limited the number of simultaneous automated dependency update pull requests for GitHub Actions and npm.

Walkthrough

The Dependabot configuration now limits open pull requests to two for GitHub Actions and three for npm.

Changes

Dependabot limits

Layer / File(s)	Summary
Configure ecosystem limits `.github/dependabot.yml`	GitHub Actions updates allow two open pull requests. npm updates allow three open pull requests.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to b9bce

This change safely caps Dependabot pull requests for the two configured ecosystems and is ready to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: limiting the number of open Dependabot pull requests per update block.
Description check	✅ Passed	The description directly explains the Dependabot configuration change and its purpose. The remaining template content does not make the description unrelated.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit checks the update queue
Two action pulls hop into view
Three npm carrots wait in line
Dependabot keeps the timing fine
The burrow stays calm and tidy too}

_{Comment @coderabbitai help to get the list of available commands.}

sonarqubecloud · 2026-09-12T14:15:34Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

coderabbitai Bot approved these changes Sep 12, 2026

View reviewed changes

hyperpolymath merged commit 44b5f57 into main Sep 12, 2026
29 of 39 checks passed

hyperpolymath deleted the chore/dependabot-pr-caps-2026-09-08 branch September 12, 2026 14:49

Navigation Menu

Uh oh!

chore(dependabot): cap open pull requests per update block - #102

chore(dependabot): cap open pull requests per update block#102
hyperpolymath merged 1 commit into
mainfrom
chore/dependabot-pr-caps-2026-09-08

hyperpolymath commented Sep 12, 2026

Uh oh!

coderabbitai Bot commented Sep 12, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

sonarqubecloud Bot commented Sep 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

hyperpolymath commented Sep 12, 2026

Summary

Type of change

How has this been verified?

Checklist

Notes for reviewers

Uh oh!

coderabbitai Bot commented Sep 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

sonarqubecloud Bot commented Sep 12, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Sep 12, 2026 •

edited

Loading