diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 3418ab67..29375a65 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -6,6 +6,11 @@ updates: interval: daily labels: - Dependencies + # Release Please lists the "deps" type under "Maintenance" in the changelog. + # Without an explicit prefix Dependabot copies the style of recent commits + # and ends up with "feat(deps)", which shows up under "Added". + commit-message: + prefix: deps # Wait after release before opening update PRs — gives the ecosystem time # to catch malicious releases (supply-chain protection). cooldown: @@ -37,6 +42,8 @@ updates: interval: weekly labels: - Dependencies + commit-message: + prefix: deps # Actions are pulled by SHA, but a compromised release is still a risk — # wait a week so takedowns/reverts can happen first. semver-major-days is # not supported for the github-actions ecosystem, so only the default diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml index 08ff5b89..1ef213f6 100644 --- a/.github/workflows/pr-title.yml +++ b/.github/workflows/pr-title.yml @@ -33,9 +33,9 @@ jobs: env: PR_TITLE: ${{ github.event.pull_request.title }} run: | - pattern='^(feat|fix|refactor|perf|docs|style|chore|test|build|ci|revert)(\([^()]+\))?!?: [^[:space:]].*$' + pattern='^(feat|fix|refactor|perf|docs|style|deps|chore|test|build|ci|revert)(\([^()]+\))?!?: [^[:space:]].*$' if [[ ! "$PR_TITLE" =~ $pattern ]]; then echo "::error title=Invalid PR title::The title must follow Conventional Commits, e.g. 'feat(hyva): add readiness check'. Do not start it with an emoji." - echo "Allowed types: feat, fix, refactor, perf, docs, style, chore, test, build, ci, revert" + echo "Allowed types: feat, fix, refactor, perf, docs, style, deps, chore, test, build, ci, revert" exit 1 fi diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 25a3efea..1b2f4b11 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -45,6 +45,7 @@ Examples: - `style:` - Code style changes (no version bump) - `test:` - Test updates (no version bump) - `chore:` - Maintenance tasks (no version bump) +- `deps:` - Dependency updates (patch version bump, listed under "Maintenance"; used by Dependabot) **Breaking Changes**: Add `!` after the type for major version bumps: @@ -83,7 +84,7 @@ All pull requests are merged using **squash-merge** to maintain a clean, linear - ✅ PR title becomes the commit message - ✅ All PR commits are squashed into a single commit - ✅ Easier to follow project history and revert changes if needed -- ⚠️ Do not use "Create a merge commit" or "Rebase and merge": Release Please then only sees the individual commits and ignores everything that is not a Conventional Commit +- ⚠️ The changelog is built from the PR title, so it must be a valid Conventional Commit whichever merge button is used. A merge commit also works because Release Please reads the PR title; avoid "Rebase and merge", where only the individual commits are visible and these would have to be Conventional Commits too --- diff --git a/docs/development.md b/docs/development.md index e1146da3..5b23a10d 100644 --- a/docs/development.md +++ b/docs/development.md @@ -321,6 +321,7 @@ Release Please groups changes into sections based on the Conventional Commits ty | `perf:` | **Performance** | ✅ Yes | | `docs:` | **Documentation** | ✅ Yes | | `style:` | **Styling** | ✅ Yes | +| `deps:` | **Maintenance** | ✅ Yes | | `chore:` | Chore | ❌ Hidden | | `test:` | Tests | ❌ Hidden | | `build:` | Build | ❌ Hidden | diff --git a/release-please-config.json b/release-please-config.json index 678c479c..7929a694 100644 --- a/release-please-config.json +++ b/release-please-config.json @@ -45,6 +45,11 @@ "section": "Styling", "hidden": false }, + { + "type": "deps", + "section": "Maintenance", + "hidden": false + }, { "type": "chore", "section": "Chore",