Exclude Fleet Toolchain Packages From Grouped Dependabot Bumps

[ptr727]

Summary

catalog/snippets/configs/dependabot.yml's reference config grouped every package in an
ecosystem into one catch-all PR (patterns: ["*"]), with no exclusion for the fleet's own
lint/format toolchain packages. A formatter or linter version bump can change its own output
or rule set and start flagging previously-compliant code the bump never touched, so bundling it
into the catch-all group means one tool's self-bump can block an arbitrary number of unrelated,
otherwise-mergeable dependency bumps together, indefinitely, with no obvious signal why.

Evidence

Investigated live via ptr727/ProjectTemplate#1055 ("Dependabot PRs stuck BLOCKED despite
auto-merge enabled and all checks green"). That issue's premise doesn't hold — every affected
PR checked has a real, currently-failing required check, so mergeStateStatus: BLOCKED is
GitHub behaving correctly. One of the confirmed root causes is this hub template gap:

• ptr727/PhotoCleaner#81-#84: a 13-update nuget-deps group bump included csharpier
  1.2.6 -> 1.3.0. The new csharpier version reformats raw string literals differently, so
  dotnet csharpier check . now flags pre-existing, previously-compliant code
  (PhotoCleaner/Database.cs) that the bump never touched — holding the other 12 unrelated,
  harmless updates in the same PR hostage.

Full findings (this repo and two others) posted as a comment on #1055.

Change

Add exclude-patterns to the nuget-deps and pypi-deps groups, naming the fleet-standard
toolchain package names per .agents/skills/dotnet-codestyle/SKILL.md and
.agents/skills/python-codestyle/SKILL.md:

• nuget-deps: csharpier, husky, dotnet-outdated-tool
• pypi-deps: ruff, pyright, mypy

Each excluded package falls out of the catch-all group and gets its own individual PR instead,
diagnosable and mergeable (or holdable) on its own.

actions-deps is left unchanged — the third repo in #1055's report (ESPHome-Config) hit a
different, already-tracked cause (docs/eol-lf-rollout.md), not a grouping/hostage problem.

Verification

• python3 -c "import yaml; yaml.safe_load(open('catalog/snippets/configs/dependabot.yml'))" — valid YAML.
• scripts/prose_lint.py and scripts/repo_gate.py — both clean.
• Pre-commit hooks ran clean on commit.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Documentation
  • Documented dependency update exclusions for .NET and Python tooling.
  • Clarified which development tools are excluded from automated update groups across main and develop branches.

[qodo-code-review]

PR Summary by Qodo

Isolate Toolchain Updates From Grouped Dependabot Bumps

🐞 Bug fix⚙️ Configuration changes🕐 Less than 10 minutes

AI Description

• Excludes fleet lint and formatting tools from catch-all NuGet and Python groups.
• Gives toolchain upgrades independent PRs so failures cannot block unrelated dependency updates.
• Applies identical exclusions to main and develop while preserving grouped GitHub Actions updates.

Diagram

graph TD
A["Dependency Update"] --> B["Ecosystem Group"] --> C{"Toolchain Package?"}
C -- "No" --> D["Grouped Update PR"]
C -- "Yes" --> E["Individual Tool PR"]

Loading

High-Level Assessment

Using Dependabot's native exclude-patterns is the most direct approach because it preserves catch-all grouping for ordinary dependencies while automatically generating standalone PRs for risky toolchain self-updates. Separate named tool groups were considered but would still couple independent tool upgrades and add unnecessary configuration.

Files changed (1) +21 / -0

Other (1) +21 / -0

dependabot.ymlExclude fleet toolchains from catch-all dependency groups+21/-0

Exclude fleet toolchains from catch-all dependency groups

• Adds NuGet exclusions for csharpier, husky, and dotnet-outdated-tool, plus Python exclusions for ruff, pyright, and mypy. The exclusions apply on both main and develop, with comments explaining why toolchain upgrades require independent PRs.

catalog/snippets/configs/dependabot.yml

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: bc85a32e-471f-415f-8fe8-92cacd59daa4

📥 Commits

Reviewing files that changed from the base of the PR and between 68f363d and 2449033.

📒 Files selected for processing (1)

• catalog/snippets/configs/dependabot.yml

Included review availability: Your plan provides up to 10 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

Dependabot configuration now documents and applies exclusions for formatter, linter, and tooling packages in grouped NuGet and UV/PyPI updates targeting main and develop.

Changes

Dependabot exclusions

Layer / File(s)	Summary
Grouped update exclusions catalog/snippets/configs/dependabot.yml	The configuration documents the exclusion strategy. NuGet groups exclude csharpier, husky, and dotnet-outdated-tool. UV/PyPI groups exclude ruff, pyright, and mypy for both branches.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk:⚪ Minimal · up to 24490

The change separates specified toolchain updates from grouped dependency bumps without introducing an actionable merge-blocking risk; it is merge-ready after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: excluding fleet toolchain packages from grouped Dependabot updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-dependabot-toolchain-grouping

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1)📘 Rule violations (0)📜 Skill insights (1)

1. Lowercase from in title 📜 Skill insight✧ Quality

Description

The PR title uses From as an uppercase short bind word. Per the title-style rule, from must be
lowercase when it appears in the middle of a title.

Code

catalog/snippets/configs/dependabot.yml[13]

+# Each group's exclude-patterns keeps the fleet's own lint/format toolchain packages out of the catch-all bump.

Relevance

●●● Strong

Recent repository history consistently accepts deterministic capitalization and prose-style
corrections.

PR-#12
PR-#991

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The supplied PR title contains From in the middle, while the checklist requires lowercase short
bind words in title case titles. The cited changed file is the PR's associated modification; the
violation itself is in PR metadata.

catalog/snippets/configs/dependabot.yml[13-13]
Skill: comment-and-doc-style

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
## Issue description
The PR title `Exclude Fleet Toolchain Packages From Grouped Dependabot Bumps` uses `From` with uppercase initial capitalization.
## Issue Context
The title-style compliance rule requires short bind words, including `from`, to remain lowercase when they are not the first or last word.
## Fix Focus Areas
- catalog/snippets/configs/dependabot.yml[13-13]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Husky.Net remains grouped 🐞 Bug≡ Correctness

Description

The new exclusion uses husky, but the fleet's .NET tool is the NuGet package Husky.Net;
Dependabot matches exclusions against dependency names. As a result, Husky.Net updates continue to
be bundled with all other NuGet updates instead of receiving an isolated PR, leaving the stated
hostage/debbugability problem unresolved for that tool.

Code

catalog/snippets/configs/dependabot.yml[31]

+ - "husky"

Relevance

●●● Strong

Recent catalog review history accepts concrete toolchain mismatches and correctness fixes; package
identity determines Dependabot matching.

PR-#963
PR-#448

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The changed entries are part of groups whose patterns: ["*"] catch every NuGet dependency.
Repository documentation identifies the tool as Husky.Net, while the snippet describes `dotnet husky
run as its command; the command name is not the NuGet package ID. Therefore the literal husky`
exclusion does not match the intended package.

catalog/snippets/configs/dependabot.yml[26-32]
catalog/snippets/configs/dependabot.yml[40-46]
catalog/snippets/husky/README.md[3-6]
.agents/skills/dotnet-codestyle/SKILL.md[51-54]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
## Issue description
The NuGet group excludes `husky`, but the dependency used by the fleet is `Husky.Net`, so Dependabot will not remove it from the catch-all group.
## Issue Context
Dependabot group `exclude-patterns` must match the dependency name. The canonical .NET codestyle documentation refers to Husky.Net, and the repository's Husky snippet invokes it as `dotnet husky`, which is only the CLI command name.
## Fix Focus Areas
- catalog/snippets/configs/dependabot.yml[31-31]
- catalog/snippets/configs/dependabot.yml[45-45]
Replace `husky` with `Husky.Net` in both NuGet group exclusions, preserving the existing Python exclusions.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 71 rules

✅ Skills: 5 invoked

comment-and-doc-style

dotnet-codestyle

python-codestyle

shell-codestyle

workflow-ci-contract

Review mode: 🚀 Fast: This is a localized, low-risk Dependabot configuration change in one file, with straightforward package exclusions and no security, schema, or broad runtime impact.

Tip of the day

💡 Did you know, you can reply 'qodo' on any finding to push back, ask questions, or dig deeper

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

1. Lowercase from in title 📜 Skill insight✧ Quality

The PR title uses From as an uppercase short bind word. Per the title-style rule, from must be
lowercase when it appears in the middle of a title.

Agent Prompt

## Issue description
The PR title `Exclude Fleet Toolchain Packages From Grouped Dependabot Bumps` uses `From` with uppercase initial capitalization.
## Issue Context
The title-style compliance rule requires short bind words, including `from`, to remain lowercase when they are not the first or last word.
## Fix Focus Areas
- catalog/snippets/configs/dependabot.yml[13-13]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[qodo-code-review]

2. Husky.net remains grouped 🐞 Bug≡ Correctness

The new exclusion uses husky, but the fleet's .NET tool is the NuGet package Husky.Net;
Dependabot matches exclusions against dependency names. As a result, Husky.Net updates continue to
be bundled with all other NuGet updates instead of receiving an isolated PR, leaving the stated
hostage/debbugability problem unresolved for that tool.

Agent Prompt

## Issue description
The NuGet group excludes `husky`, but the dependency used by the fleet is `Husky.Net`, so Dependabot will not remove it from the catch-all group.
## Issue Context
Dependabot group `exclude-patterns` must match the dependency name. The canonical .NET codestyle documentation refers to Husky.Net, and the repository's Husky snippet invokes it as `dotnet husky`, which is only the CLI command name.
## Fix Focus Areas
- catalog/snippets/configs/dependabot.yml[31-31]
- catalog/snippets/configs/dependabot.yml[45-45]
Replace `husky` with `Husky.Net` in both NuGet group exclusions, preserving the existing Python exclusions.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools