Promote Develop to Main by ptr727 · Pull Request #1063 · ptr727/ProjectTemplate

ptr727 · 2026-08-28T17:19:52Z

Promotes #1062 (Exclude Fleet Toolchain Packages From Grouped Dependabot Bumps) from develop to main.

🤖 Generated with Claude Code

Summary by CodeRabbit

Documentation
- Documented why selected toolchain packages are excluded from grouped dependency updates.
- Updated dependency update settings for the main and develop branches to keep CSharpier, Husky, dotnet-outdated-tool, Ruff, Pyright, and Mypy updates separate.

## Summary `catalog/snippets/configs/dependabot.yml`'s reference config grouped every package in an ecosystem into one catch-all PR (`patterns: ["*"]`), with no exclusion for the fleet's own lint/format toolchain packages. A formatter or linter version bump can change its own output or rule set and start flagging previously-compliant code the bump never touched, so bundling it into the catch-all group means one tool's self-bump can block an arbitrary number of unrelated, otherwise-mergeable dependency bumps together, indefinitely, with no obvious signal why. ## Evidence Investigated live via `#1055` ("Dependabot PRs stuck BLOCKED despite auto-merge enabled and all checks green"). That issue's premise doesn't hold — every affected PR checked has a real, currently-failing required check, so `mergeStateStatus: BLOCKED` is GitHub behaving correctly. One of the confirmed root causes is this hub template gap: - `ptr727/PhotoCleaner#81`-`#84`: a 13-update `nuget-deps` group bump included `csharpier` 1.2.6 -> 1.3.0. The new csharpier version reformats raw string literals differently, so `dotnet csharpier check .` now flags pre-existing, previously-compliant code (`PhotoCleaner/Database.cs`) that the bump never touched — holding the other 12 unrelated, harmless updates in the same PR hostage. Full findings (this repo and two others) posted as a comment on #1055. ## Change Add `exclude-patterns` to the `nuget-deps` and `pypi-deps` groups, naming the fleet-standard toolchain package names per `.agents/skills/dotnet-codestyle/SKILL.md` and `.agents/skills/python-codestyle/SKILL.md`: - `nuget-deps`: `csharpier`, `husky`, `dotnet-outdated-tool` - `pypi-deps`: `ruff`, `pyright`, `mypy` Each excluded package falls out of the catch-all group and gets its own individual PR instead, diagnosable and mergeable (or holdable) on its own. `actions-deps` is left unchanged — the third repo in #1055's report (ESPHome-Config) hit a different, already-tracked cause (`docs/eol-lf-rollout.md`), not a grouping/hostage problem. ## Verification - `python3 -c "import yaml; yaml.safe_load(open('catalog/snippets/configs/dependabot.yml'))"` — valid YAML. - `scripts/prose_lint.py` and `scripts/repo_gate.py` — both clean. - Pre-commit hooks ran clean on commit. 🤖 Generated with [Claude Code](https://claude.com/claude-code)  ## Summary by CodeRabbit * **Documentation** * Documented dependency update exclusions for .NET and Python tooling. * Clarified which development tools are excluded from automated update groups across main and develop branches.

qodo-code-review · 2026-08-28T17:20:24Z

PR Summary by Qodo

Isolate Toolchain Updates From Grouped Dependabot Bumps

🐞 Bug fix⚙️ Configuration changes🕐 Less than 10 minutes

AI Description

• Excludes .NET and Python lint/format tools from catch-all Dependabot groups.
• Gives toolchain upgrades isolated PRs across main and develop targets.

Diagram

graph TD
E["Dependabot config"] --> B{"Toolchain package?"} -->|Yes| C["Individual PR"]
B -->|No| D["Grouped PR"]
A["Dependency update"] --> B

High-Level Assessment

Package exclusions are the appropriate strategy because they preserve catch-all grouping for routine dependencies while isolating formatter, linter, and type-checker upgrades that can invalidate existing code. Dedicated toolchain groups were considered but would still couple unrelated tool upgrades and their potentially conflicting remediation work.

Files changed (1) +21 / -0

Other (1) +21 / -0

dependabot.ymlExclude code-quality tools from grouped dependency updates+21/-0

Exclude code-quality tools from grouped dependency updates

• Adds ecosystem-specific exclusions for CSharpier, Husky, dotnet-outdated-tool, Ruff, Pyright, and mypy on both main and develop targets. Comments document why self-updating code-quality tools require isolated Dependabot PRs.

catalog/snippets/configs/dependabot.yml

coderabbitai · 2026-08-28T17:21:01Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: aaadd1d6-1337-455e-874f-3cfb3ddd3594

📥 Commits

Reviewing files that changed from the base of the PR and between 9c55856 and 4ba79f9.

📒 Files selected for processing (1)

catalog/snippets/configs/dependabot.yml

Included review availability: Your plan provides up to 10 included reviews per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

Dependabot now excludes formatter, linter, and related toolchain packages from grouped NuGet and Python uv updates on the main and develop branches. Comments document the exclusion rationale.

Changes

Dependabot grouping

Layer / File(s)	Summary
Toolchain dependency exclusions `catalog/snippets/configs/dependabot.yml`	The NuGet groups exclude `csharpier`, `husky`, and `dotnet-outdated-tool`. The Python `uv` groups exclude `ruff`, `pyright`, and `mypy`. Comments document the rationale for these exclusions.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk:⚪ Minimal · up to 4ba79

This localized configuration promotion has no actionable merge-blocking risk remaining and is merge-ready after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the primary purpose of the pull request: promoting the Dependabot configuration changes from Develop to Main.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch develop

_{Comment @coderabbitai help to get the list of available commands.}

qodo-code-review · 2026-08-28T17:24:39Z

Code Review by Qodo

🐞 Bugs (0)📘 Rule violations (0)📜 Skill insights (0)

1. ~~Comment block is overly long~~✓ Resolved📜 Skill insight⚙ Maintainability

Description

The added four-line prose block elaborates on the same Dependabot exclusion rationale rather than
keeping the comment to one concise line. This violates the default one-line comment requirement.

Code

catalog/snippets/configs/dependabot.yml[R13-16]

+# Each group's exclude-patterns keeps the fleet's own lint/format toolchain packages out of the catch-all bump.+# A formatter or linter version bump can change its own output or rule set and start flagging previously-compliant code it never touched.+# Grouping it with unrelated dependency bumps would then block all of them together on one tool's reformat/relint debt.+# Excluded packages instead get their own individual PR, diagnosed and merged (or held) on its own.

Relevance

●●● Strong
Recent accepted precedent supports reformatting lengthy comments to follow repository comment-style
guidance.
PR-#448
ⓘ Recommendations generated based on similar findings in past PRs

Evidence

PR Compliance ID 2826677 requires comments to be one line by default and permits a second line only
for a genuine constraint. The added lines form a four-sentence explanatory block about one exclusion
decision.

catalog/snippets/configs/dependabot.yml[13-16]
Skill: comment-and-doc-style

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution
## Issue description
The four-line Dependabot rationale is an elaborative prose block where comments must be one line by default.
## Issue Context
Retain only the essential reason that toolchain packages receive separate PRs, and remove the extended explanation.
## Fix Focus Areas
- catalog/snippets/configs/dependabot.yml[13-16]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Context sources

✅ Compliance rules (platform): 71 rules

✅ Skills: 5 invoked

comment-and-doc-style

dotnet-codestyle

python-codestyle

shell-codestyle

workflow-ci-contract

✅ Web pages:

🌐 alirezanet/Husky.Net

🌐 README.md at master · alirezanet/Husky.Net

🌐 Releases · alirezanet/Husky.Net · GitHub

+14 more

Review mode: ⚖️ Balanced

Tip of the day

💡 Did you know, you can reply 'qodo' on any finding to push back, ask questions, or dig deeper

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Qodo flagged the 4-line rationale comment added in #1062 as an elaborative prose block, against the fleet's "one line is the default, a second line is earned only by a constraint the code cannot otherwise carry" comment rule (found on the #1063 promotion PR, whose diff doesn't allow a direct fix, hence this separate feature PR). Trims it to the two sentences that carry the non-obvious why, dropping the lines that restated what the code already shows. ## Verification - `scripts/prose_lint.py catalog/snippets/configs/dependabot.yml` — clean. - `scripts/repo_gate.py` — clean. - YAML syntax check — valid. 🤖 Generated with [Claude Code](https://claude.com/claude-code)  ## Summary by CodeRabbit * **Documentation** * Clarified Dependabot configuration comments about toolchain exclusions and version updates. * Documented how tool version changes may affect existing code and grouped updates.

qodo-code-reviewBot reviewed Aug 28, 2026
View reviewed changes

Comment threadcatalog/snippets/configs/dependabot.yml Outdated

ptr727 mentioned this pull request Aug 28, 2026
Tighten Dependabot Exclude-Patterns Rationale Comment #1064
Merged

ptr727 merged commit 510aa0b into mainAug 28, 2026
8 checks passed

Navigation Menu

Promote Develop to Main - #1063

Promote Develop to Main#1063
ptr727 merged 2 commits into
mainfrom
develop

ptr727 commented Aug 28, 2026•
edited by coderabbitai Bot
Loading

Uh oh!

qodo-code-reviewBot commented Aug 28, 2026

Uh oh!

coderabbitaiBot commented Aug 28, 2026•
edited
Loading

Walkthrough

Changes

Uh oh!

qodo-code-reviewBot commented Aug 28, 2026•
edited
Loading

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

ptr727 commented Aug 28, 2026• edited by coderabbitai BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

qodo-code-reviewBot commented Aug 28, 2026

PR Summary by Qodo

Uh oh!

coderabbitaiBot commented Aug 28, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

qodo-code-reviewBot commented Aug 28, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ptr727 commented Aug 28, 2026•
edited by coderabbitai Bot
Loading

coderabbitaiBot commented Aug 28, 2026•
edited
Loading

qodo-code-reviewBot commented Aug 28, 2026•
edited
Loading