Skip to content

chore(dependabot): cap open pull requests per update block - #66

Merged
hyperpolymath merged 2 commits into
mainfrom
chore/dependabot-pr-caps-2026-09-08
Sep 18, 2026
Merged

hyperpolymath merged 2 commits into
mainfrom
chore/dependabot-pr-caps-2026-09-08

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Adds open-pull-requests-limit to Dependabot update blocks that had no cap, following the estate per-ecosystem cap doctrine (task #37). No other line in the file is touched.

Claude-Session: https://claude.ai/code/session_011eQ7hibx92N7fBDtwgReWk

Summary

Changes

RSR Quality Checklist

Required

  • Tests pass (just test or equivalent)
  • Code is formatted (just fmt or equivalent)
  • Linter is clean (no new warnings or errors)
  • No banned language patterns (no TypeScript, no npm/bun, no Go/Python)
  • No unsafe blocks without // SAFETY: comments
  • No banned functions (believe_me, unsafeCoerce, Obj.magic, Admitted, sorry)
  • SPDX license headers present on all new/modified source files
  • No secrets, credentials, or .env files included

As Applicable

  • .machine_readable/6a2/STATE.a2ml updated (if project state changed)
  • .machine_readable/6a2/ECOSYSTEM.a2ml updated (if integrations changed)
  • .machine_readable/6a2/META.a2ml updated (if architectural decisions changed)
  • Documentation updated for user-facing changes
  • TOPOLOGY.md updated (if architecture changed)
  • CHANGELOG or release notes updated
  • New dependencies reviewed for license compatibility (MPL-2.0 / MPL-2.0)
  • ABI/FFI changes validated (src/interface/abi/ and src/interface/ffi/ consistent)

Testing

Screenshots

Adds `open-pull-requests-limit` to Dependabot update blocks that had no
cap, following the estate per-ecosystem cap doctrine (task #37).
No other line in the file is touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011eQ7hibx92N7fBDtwgReWk
@coderabbitai

coderabbitai Bot commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 79474df5-d5cf-427c-8202-36fcaf27fbc4

📥 Commits

Reviewing files that changed from the base of the PR and between acb0abb and b269770.

📒 Files selected for processing (1)
  • .github/dependabot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (9)
  • GitHub Check: governance / Validate Hypatia Baseline
  • GitHub Check: Dogfooding compliance summary
  • GitHub Check: governance / Trusted-base reduction policy
  • GitHub Check: governance / Debt ratchet
  • GitHub Check: governance / Licence consistency
  • GitHub Check: governance / Exemption ratchet
  • GitHub Check: governance / Live Actions policy (credentialed advisory)
  • GitHub Check: governance / Code quality + docs
  • GitHub Check: Hypatia neurosymbolic scan
⚠️ CI failures not shown inline (4)

GitHub Actions: SonarQube / 0_SonarQube.txt: chore(dependabot): cap open pull requests per update block

Conclusion: failure

View job details

##[group]Run SonarSource/sonarqube-scan-action@v8.2.1
 with:
   projectBaseDir: .
   scannerVersion: 8.1.0.6389
   scannerBinariesUrl: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli
   skipSignatureVerification: false
 env:
   SONAR_***REDACTED_SECRET_ASSIGNMENT***
 ##[warning]Running this GitHub Action without SONAR_TOKEN is not recommended
 Installing Sonar Scanner CLI 8.1.0.6389 for linux-x64...
 Downloading from: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.1.0.6389-linux-x64.zip
 Downloading signature from: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.1.0.6389-linux-x64.zip.asc
 Importing SonarSource public key from hkps://keyserver.ubuntu.com...
 [command]/usr/bin/gpg --homedir /home/runner/work/_temp/gpg-3eaadfef --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 679F1EE92B19609DE816FDE81DB198F93525EC1A
 gpg: keybox '/home/runner/work/_temp/gpg-3eaadfef/pubring.kbx' created
 gpg: /home/runner/work/_temp/gpg-3eaadfef/trustdb.gpg: trustdb created
 gpg: key 1DB198F93525EC1A: public key "SonarSource S.A. <infra@sonarsource.com>" imported
 gpg: Total number processed: 1
 gpg:               imported: 1
 Successfully imported key from hkps://keyserver.ubuntu.com
 ✓ SonarSource public key imported successfully
 Verifying GPG signature...
 [command]/usr/bin/gpg --homedir /home/runner/work/_temp/gpg-3eaadfef --batch --verify /home/runner/work/_temp/663cd760-9f7f-401f-bd3e-1f4e47b90a98 /home/runner/work/_temp/fde8fe3e-4061-409b-81c1-5d5a7ce7a182
 gpg: Signature made Tue Apr 21 07:20:26 2026 UTC
 gpg:                using RSA key D1436C0DBACEA48702AF97C363F1DD7753B8B315
 gpg: Good signature from "SonarSource S.A. <infra@sonarsource.com>" [unknown]
 gpg: WARNING: This key is not certified with a trusted signature!
 gpg:          There is no indication that the signature belongs to the owner.
 Primary key fingerprint: 679F 1EE9 2B19 609D E816  FDE8 1DB1 98F9 3525 EC1A...

GitHub Actions: Estate Rules / 0_estate-rules.txt: chore(dependabot): cap open pull requests per update block

Conclusion: failure

View job details

##[group]Run bash scripts/check-root-shape.sh .
 �[36;1mbash scripts/check-root-shape.sh .�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 FAIL: 4 root entries are not on the allowlist:
   - ARCHITECTURE.adoc
   - CHANGELOG.adoc
   - CONTRIBUTING.adoc
   - GEMINI.md
 Either move them into the appropriate subdirectory, or add a justified
 entry to .machine_readable/root-allow.txt.
 ##[error]Process completed with exit code 1.

GitHub Actions: SonarQube / SonarQube: chore(dependabot): cap open pull requests per update block

Conclusion: failure

View job details

##[group]Run SonarSource/sonarqube-scan-action@v8.2.1
 with:
   projectBaseDir: .
   scannerVersion: 8.1.0.6389
   scannerBinariesUrl: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli
   skipSignatureVerification: false
 env:
   SONAR_***REDACTED_SECRET_ASSIGNMENT***
 ##[warning]Running this GitHub Action without SONAR_TOKEN is not recommended
 Installing Sonar Scanner CLI 8.1.0.6389 for linux-x64...
 Downloading from: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.1.0.6389-linux-x64.zip
 Downloading signature from: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.1.0.6389-linux-x64.zip.asc
 Importing SonarSource public key from hkps://keyserver.ubuntu.com...
 [command]/usr/bin/gpg --homedir /home/runner/work/_temp/gpg-3eaadfef --batch --keyserver hkps://keyserver.ubuntu.com --recv-keys 679F1EE92B19609DE816FDE81DB198F93525EC1A
 gpg: keybox '/home/runner/work/_temp/gpg-3eaadfef/pubring.kbx' created
 gpg: /home/runner/work/_temp/gpg-3eaadfef/trustdb.gpg: trustdb created
 gpg: key 1DB198F93525EC1A: public key "SonarSource S.A. <infra@sonarsource.com>" imported
 gpg: Total number processed: 1
 gpg:               imported: 1
 Successfully imported key from hkps://keyserver.ubuntu.com
 ✓ SonarSource public key imported successfully
 Verifying GPG signature...
 [command]/usr/bin/gpg --homedir /home/runner/work/_temp/gpg-3eaadfef --batch --verify /home/runner/work/_temp/663cd760-9f7f-401f-bd3e-1f4e47b90a98 /home/runner/work/_temp/fde8fe3e-4061-409b-81c1-5d5a7ce7a182
 gpg: Signature made Tue Apr 21 07:20:26 2026 UTC
 gpg:                using RSA key D1436C0DBACEA48702AF97C363F1DD7753B8B315
 gpg: Good signature from "SonarSource S.A. <infra@sonarsource.com>" [unknown]
 gpg: WARNING: This key is not certified with a trusted signature!
 gpg:          There is no indication that the signature belongs to the owner.
 Primary key fingerprint: 679F 1EE9 2B19 609D E816  FDE8 1DB1 98F9 3525 EC1A...

GitHub Actions: Estate Rules / estate-rules: chore(dependabot): cap open pull requests per update block

Conclusion: failure

View job details

##[group]Run bash scripts/check-root-shape.sh .
 �[36;1mbash scripts/check-root-shape.sh .�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 FAIL: 4 root entries are not on the allowlist:
   - ARCHITECTURE.adoc
   - CHANGELOG.adoc
   - CONTRIBUTING.adoc
   - GEMINI.md
 Either move them into the appropriate subdirectory, or add a justified
 entry to .machine_readable/root-allow.txt.
 ##[error]Process completed with exit code 1.
🔇 Additional comments (1)
.github/dependabot.yml (1)

16-16: LGTM!

Also applies to: 41-41, 48-48, 55-55


📝 Summary

Summary by CodeRabbit

  • Chores
    • Limited automated dependency update pull requests to help reduce notification volume.
    • GitHub Actions updates are limited to two open pull requests.
    • Mix, npm, and pip updates are limited to three open pull requests.
    • Cargo remains restricted to security updates.

Walkthrough

The Dependabot configuration now limits open pull requests for GitHub Actions, Mix, npm, and pip updates.

Changes

Dependabot pull request limits

Layer / File(s) Summary
Configure update limits
.github/dependabot.yml
GitHub Actions updates are limited to 2 open pull requests. Mix, npm, and pip updates are each limited to 3.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 0b5fe

The configuration-only change adds the stated Dependabot pull-request caps without an identified production or workflow risk.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description includes a useful summary, but the required template sections remain incomplete. The Summary and Changes sections contain no completed content, the Testing section is empty, the Screen… Complete the Summary and Changes sections, state how the change was tested, mark applicable checklist items, and state why non-applicable items do not apply. Add screenshots or terminal output if applicable.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the main change: adding limits to Dependabot pull requests. It is concise and specific.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Full details: Description check

Explanation

The description includes a useful summary, but the required template sections remain incomplete. The Summary and Changes sections contain no completed content, the Testing section is empty, the Screenshots section is empty, and all checklist items remain unchecked.

✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Commit to this branch
  • Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

A rabbit checks the update queue
Two action hops come through
Three Mix, npm, and pip
Keep each queue in trim
Dependabot rests easy
With tidy limits in view

Comment @coderabbitai help to get the list of available commands.

@hyperpolymath
hyperpolymath merged commit 799bf08 into main Sep 18, 2026
29 of 37 checks passed
@hyperpolymath
hyperpolymath deleted the chore/dependabot-pr-caps-2026-09-08 branch September 18, 2026 11:31
@sonarqubecloud

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant