Repository navigation
Set up Dependabot for Actions, dotnet CLI tools, and NuGet packages #30
Description
What to build
Out-of-date dependencies announce themselves as pull requests instead of rotting silently. After this ticket, Dependabot watches every version surface the build depends on — GitHub Actions pins (keeping the SHA pin and its version comment in sync), the dotnet CLI tools manifest (nbgv, wix, sbom-tool), and the NuGet package references in the plugin and test projects — and opens bump PRs that the existing Tests and Build jobs gate green-or-red. No manual "remember to bump the tool" tickets again.
Decisions already made (don't re-litigate):
- Weekly schedule; minor+patch updates grouped per ecosystem into one PR; majors arrive as their own open PRs with no ignore-conditions — CI gating is the judge.
- All feeds are public nuget.org (the Milestone MIP SDK package restores from nuget.org in CI today); no registry credentials should be needed. If Dependabot's NuGet resolution cannot see the MIP SDK package, record that on this ticket and ignore-conditions only that one package — everything else stays live.
Acceptance criteria
- A Dependabot config lands on
main, listed as valid (no config errors) in the repository's Dependabot overview - Three ecosystems covered: Actions; the dotnet CLI tools manifest; NuGet package references of both the plugin project and the test project
- Actions bump PRs update the pinned commit SHA and its trailing version comment together
- Known drift produces a real bump PR (the nbgv CLI tool is behind: 3.6.139 → 3.10.9x); the Tests and Build jobs run on it, and its green/red verdict is posted on this ticket
- Major bumps open as PRs without ignore-conditions (WiX 5→7 will land as one; do not merge it here — ticket "WiX toolset 5→7 coordinated bump" owns that)
- Dependabot security updates are enabled for the repository
Blocked by
- None (can start immediately).
Activity
joshooaj commentedon Oct 28, 2026
Dependabot is live — verdicts posted per acceptance criteria
Config landed on
mainvia #39 (initial), #40 (schema fix:update-typesmust be shortminor/patchnames), #43 (NuGet scoping, see below). The.github/dependabot.ymlvalidation check runs green on currentmain(1222f2d) — config listed valid.Ecosystems:
github-actionsentry covers the SHA-pin+comment style inci.yml/release.yml(built-in behavior: Dependabot updates the pinned SHA and its trailing version comment together). No bump PR yet: all six pins (checkout v7.0.1, setup-dotnet v6.0.0, cache v6.1.0, upload-artifact v7.0.2, setup-msbuild v3, Azure/login v3.1.0) are currently at their latest — the first weekly check will open PRs whenever drift appears..config/dotnet-tools.json. First run produced Bump the nuget-minor-and-patch group with 2 updates #41 (nbgv + wix-patch) and Bump wix from 5.0.1 to 7.0.1 #42 (wix 5.0.1 → 7.0.1, the WiX 5→7 major: opened, gated green, left unmerged — owned by the coordinated-bump ticket).directory: "/"; it only found the tools manifest. ci: scope Dependabot nuget entry to the projects with PackageReferences #43 resorted todirectories: ["/", "/src/WebContent", "/src/WebContent.Tests"], after which grouped/minor+patch PRs touched both csproj.tests/uxis deliberately excluded (CI does not gate it);src/Setup/setup.wixprojWiX-extension PackageReferences are likewise out of the ticket's named surfaces.Known-drift bump PR (criterion 4): #44 "Bump the nuget-minor-and-patch group with 6 updates" includes nbgv 3.6.139 → 3.10.94 (plus wix 5.0.2, Microsoft.NET.Test.Sdk 17.11.1→17.14.1, xunit 2.9.2→2.9.3, WebView2 1.0.4078.44→1.0.4314.35, Nerdbank.GitVersioning 3.10.91→3.10.94).
Verdict: GREEN —
Testspass (1m26s) andBuildpass (1m36s): https://github.com/joshooaj/WebContentPlugin/actions/runs/40777304768Majors open as their own PRs, no ignore-conditions (criterion 5): #45 (Microsoft.NET.Test.Sdk 17→18) and #46 (xunit.runner.visualstudio 2→4) — both opened as standalone PRs. The MIP SDK package (
MilestoneSystems.VideoOS.Platform26.1.2, current on nuget.org) resolved fine from public feeds — no ignore-conditions were needed at all, including for it. (Note: Dependabot closed #41/#42 as "Superseded by #44" when the config re-scoped; the WiX 5→7 PR will reappear at the next weekly check, and #44's wix 5.0.2 patch doesn't conflict with that owner's coordinated bump.)Security updates (criterion 6): enabled via repo settings (
security_and_analysis.dependabot_security_updates→ enabled); the vulnerability-alerts API confirms Dependabot alerts are active.Grouping observed as decided: minor+patch updates land in one grouped PR per ecosystem; majors arrive individually.