Skip to content

chore(dependabot): cap open pull requests per ecosystem - #51

Merged
hyperpolymath merged 1 commit into
mainfrom
chore/dependabot-pr-caps-2026-09-08
Sep 9, 2026
Merged

hyperpolymath merged 1 commit into
mainfrom
chore/dependabot-pr-caps-2026-09-08

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Adds open-pull-requests-limit to the Dependabot blocks in this repository
that did not have one.

Why. Without an explicit limit, Dependabot defaults to 5 open PRs per
ecosystem. Across the estate that produced a large, permanently-refreshing
backlog that costs more to triage than the updates are worth. An estate-wide
audit found 3,024 uncapped blocks across 1,429 config files.

The cap applied here follows the per-ecosystem doctrine already recorded in
rsr-template-repo, not a single flat number: github-actions 2, cargo 0,
mix/npm/pip 3.

How this commit was built. The change was made with git plumbing against
origin/<default branch>, not by staging a working tree. The branch therefore
contains exactly one commit touching exactly one file, and carries none of the
unrelated local state present in this checkout. A per-repository assertion
required git diff --name-only <base> <commit> to equal the expected path set
exactly, or the branch was never created.

Repositories whose HEAD already differed from the base on this file were
skipped, not overwritten, so no unpushed local work is discarded or
silently folded into this PR.

This PR is opened as a draft on purpose. It is part of a bulk campaign and
is not requesting a merge. Review and merge at your discretion.

🤖 Generated with Claude Code

https://claude.ai/code/session_011eQ7hibx92N7fBDtwgReWk

Adds `open-pull-requests-limit` to Dependabot update blocks that had no
cap, following the estate per-ecosystem cap doctrine (task #37).
No other line in the file is touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011eQ7hibx92N7fBDtwgReWk
@coderabbitai

coderabbitai Bot commented Sep 8, 2026 •

Copy link
Copy Markdown

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 83e2a780-85b5-4531-8d77-55b60eac39a0

📥 Commits

Reviewing files that changed from the base of the PR and between af4682e and 83ab2cd.

📒 Files selected for processing (1)
  • .github/dependabot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (13)
  • GitHub Check: scan / gitleaks
  • GitHub Check: scan / shell-secrets
  • GitHub Check: scan / rust-secrets
  • GitHub Check: governance / Trusted-base reduction policy
  • GitHub Check: governance / Security policy checks
  • GitHub Check: governance / Licence consistency
  • GitHub Check: governance / Well-Known (RFC 9116 + RSR)
  • GitHub Check: governance / Language / package anti-pattern policy
  • GitHub Check: governance / Check Workflow Staleness
  • GitHub Check: governance / Code quality + docs
  • GitHub Check: governance / Guix primary / Nix fallback policy
  • GitHub Check: governance / Workflow security linter
  • GitHub Check: scan / Hypatia Neurosymbolic Analysis
🔇 Additional comments (1)
.github/dependabot.yml (1)

11-11: LGTM!


📝 Summary

Summary by CodeRabbit

  • Chores
    • Limited Dependabot to a maximum of two open pull requests for GitHub Actions updates.

Walkthrough

The Dependabot configuration now limits the github-actions ecosystem to two open pull requests.

Changes

Dependabot configuration

Layer / File(s) Summary
Set the open pull request limit
.github/dependabot.yml
The github-actions configuration sets open-pull-requests-limit to 2.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 83ab2

GitHub Actions Dependabot updates are capped at two open pull requests, reducing update volume without changing application behavior. The change is ready to merge.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title clearly and concisely identifies the main change: limiting Dependabot open pull requests per ecosystem.
Description check ✅ Passed The description directly explains the Dependabot limit, the per-ecosystem values, and the scope of the change.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

A rabbit checks the action queue,
Two little pull requests will do.
No crowded burrows, neat and bright,
Dependabot hops along just right,
With tidy updates through the night.

Comment @coderabbitai help to get the list of available commands.

@hyperpolymath
hyperpolymath marked this pull request as ready for review September 9, 2026 00:09
@hyperpolymath
hyperpolymath merged commit 27a833d into main Sep 9, 2026
17 checks passed
@hyperpolymath
hyperpolymath deleted the chore/dependabot-pr-caps-2026-09-08 branch September 9, 2026 00:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant