From 2cb091c3a5cb9de53cbbf3ed2773516add111f21 Mon Sep 17 00:00:00 2001 From: Rachael Graham Date: Tue, 22 Sep 2026 12:54:41 -0500 Subject: [PATCH] ci: replace Snyk upgrade PRs with Dependabot Snyk's automatic upgrade PRs can never pass the DCO check. The check is the Probot DCO app, which exempts bots by testing the commit author's GitHub account type: dependabot[bot] is type Bot and is exempt, while snyk-bot is type User and is not. Snyk offers no sign-off option and the DCO app has no allowlist, so the two cannot be reconciled by config. The check has not been blocking anything -- the repo has no branch protection, so 46 of 66 all-time Snyk PRs merged with DCO in ACTION_REQUIRED. That has put unsigned snyk-bot commits on main in quantity and trained everyone to merge past a permanently red check. Moving to Dependabot makes DCO pass on its own and restores the signal. Snyk keeps its security/snyk and license/snyk status checks; only the PR-opening automation moves. Disable automatic fix/upgrade PRs for the website project in app.snyk.io org kagent, or both bots will open PRs for the same bumps. The config covers all three tracked npm projects -- the root Next.js site, /docs-site, and /docs-site/playwright. Every Snyk PR only ever targeted the root, so the other two have had no dependency automation at all. Grouped minor/patch with majors suppressed, following the pattern already in kagent-dev/kagent. Reviewers come from CODEOWNERS. Also adds .github/dco.yml allowing remediation commits, so a maintainer can retroactively sign off on a human contributor's commit instead of asking them to rebase. This does not affect the Snyk case. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Rachael Graham --- .github/dco.yml | 7 +++ .github/dependabot.yml | 101 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 108 insertions(+) create mode 100644 .github/dco.yml create mode 100644 .github/dependabot.yml diff --git a/.github/dco.yml b/.github/dco.yml new file mode 100644 index 00000000..6fd8a57f --- /dev/null +++ b/.github/dco.yml @@ -0,0 +1,7 @@ +# Lets a maintainer retroactively sign off on a contributor's commit by +# pushing a follow-up commit, instead of asking them to rebase. +# The DCO app already exempts Bot-type accounts (dependabot[bot]); this +# covers human drive-by contributions that arrive without a Signed-off-by. +allowRemediationCommits: + individual: true + thirdParty: true diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..32bc6e95 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,101 @@ +version: 2 + +# Replaces Snyk's automatic upgrade PRs. Snyk's `security/snyk` and +# `license/snyk` checks still run on every PR; only the PR-opening +# automation moves here. Dependabot commits are authored by +# dependabot[bot], a Bot-type account, which the DCO app exempts by +# default -- snyk-bot is a User-type account, so its commits never +# satisfied DCO. +# +# Reviewers come from CODEOWNERS, which already covers this repo. + +updates: + # GitHub Actions -- keep CI workflows up to date + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + open-pull-requests-limit: 10 + labels: + - "dependencies" + commit-message: + prefix: "chore(deps):" + groups: + actions: + patterns: + - "*" + update-types: + - "minor" + - "patch" + + # npm -- Next.js marketing site at the repo root + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + open-pull-requests-limit: 10 + labels: + - "dependencies" + commit-message: + prefix: "chore(deps):" + ignore: + # Majors (Next.js, React) are migrations, not routine bumps. Raise + # them deliberately; minor/patch still flows through the group below. + - dependency-name: "*" + update-types: + - "version-update:semver-major" + groups: + npm-minor-patch: + patterns: + - "*" + update-types: + - "minor" + - "patch" + + # npm -- Hugo docs site toolchain + - package-ecosystem: "npm" + directory: "/docs-site" + schedule: + interval: "weekly" + day: "monday" + open-pull-requests-limit: 5 + labels: + - "dependencies" + commit-message: + prefix: "chore(deps):" + ignore: + - dependency-name: "*" + update-types: + - "version-update:semver-major" + groups: + docs-site-minor-patch: + patterns: + - "*" + update-types: + - "minor" + - "patch" + + # npm -- Playwright screenshot harness + - package-ecosystem: "npm" + directory: "/docs-site/playwright" + schedule: + interval: "weekly" + day: "monday" + open-pull-requests-limit: 5 + labels: + - "dependencies" + commit-message: + prefix: "chore(deps):" + ignore: + - dependency-name: "*" + update-types: + - "version-update:semver-major" + groups: + playwright-minor-patch: + patterns: + - "*" + update-types: + - "minor" + - "patch"