Repository navigation
ci: configure Dependabot for Bun lockfile - #29
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 19ea5e87e7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| version: 2 | ||
| updates: | ||
| - package-ecosystem: "npm" | ||
| - package-ecosystem: "bun" |
There was a problem hiding this comment.
This activates the Bun updater against a bun.lock whose lockfileVersion is 2; hosted Dependabot currently rejects versions above 1 rather than updating them (#15896). Consequently the weekly root update job will fail with DependencyFileNotSupported and no dependency PRs will be opened. Regenerate or restamp the lockfile to a supported version before enabling this ecosystem.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
🟢 Approval recommended
The configuration matches the repository’s supported Bun lockfile and preserves existing GitHub Actions updates.
0 open findings
What changed in this PR
Updates Dependabot to manage the repository’s Bun dependencies correctly.
Changes:
- Switches the root package ecosystem from npm to Bun.
- Leaves GitHub Actions updates unchanged.
| File | Description |
|---|---|
.github/dependabot.yml |
Targets bun.lock using the Bun ecosystem. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Problem
The scheduled Dependabot run fails because this repository has
bun.lock, not an npm/yarn/pnpm lockfile. The log explicitly saysnpm_and_yarncannot update this project and recommends thebunecosystem.Change
Switch the root dependency update target from
npmtobun. Keep the GitHub Actions update target unchanged.Validation
The existing CodeSentinel CI and security checks will run on this configuration change; the next Dependabot schedule can then validate dependency updates against
bun.lock.