Repository navigation
ci: schedule bounded weekly Dependabot update proposals - #136
Conversation
Monitor development, build-tool and action dependencies in three weekly Shanghai-time scopes, with two ordinary PRs per scope and minor/patch groups. Leave majors and sensitive API/accessibility upgrades individual without ignoring security fixes. Keep merge and new-release publication manual. Add portable policy/mutation checks and bilingual contributor guidance; do not change package versions, runtime code, locks or release workflows. Co-authored-by: OpenAI Codex <215057067+openai-codex[bot]@users.noreply.github.com>
Retain the Shanghai timezone, staggered times, grouping and manual review boundaries. Update bilingual guidance and reject regression to Monday. Co-authored-by: OpenAI Codex <215057067+openai-codex[bot]@users.noreply.github.com>
Carl723000
left a comment
There was a problem hiding this comment.
中文复核
复核版本：52aa0aac236360776fce8948007d7a6e57cb101f（基于 0532c6eea6258d815cddaec6ded11396ad48f295）。未发现需要阻止合并的源代码或配置问题。
- 三个更新范围均为每周日，时区
Asia/Shanghai，依次 09:00、09:30、10:00；英文和中文贡献指南一致。 - 每类最多两个普通升级 PR；分组仅覆盖普通 minor/patch，大版本和敏感包仍独立审阅。未加入忽略规则或改变安全更新覆盖范围。
- 未改依赖、锁文件、运行时代码、产品版本或工作流；不启用自动合并，不发布新版本。保留
skip-changelog和既有必需检查。 - 周日排期红→绿及回退周一的负向测试通过；30 项聚焦检查、完整 Node 2,679 通过／2 跳过，实际 YAML 解析通过。远端文件树与本地受测树相同。
合并前仍需等待本提交的 完整 CI 全部通过；不使用旧提交结果替代，也不绕过分支保护。真实 Dependabot 作业须配置进入默认分支后再验证。
Review summary
No blocking source/configuration findings in the revision above. All three schedules are Sunday in Asia/Shanghai, preserving staggered times, bounded ordinary proposals, independent security updates and manual integration/publication boundaries. The reviewed scope is exactly configuration, its policy tests and bilingual contributor guidance. Local red/green, mutation checks, 30 focused checks, full Node tests and real YAML parsing passed; hosted-tree identity is verified. Final-head hosted CI is still a prerequisite to merging; no production bot execution is claimed.
🤖 Generated by OpenAI Codex as an automated first pass — not a maintainer decision.
中文审阅
新增 Dependabot 普通版本升级提案配置，只开 PR，不自动合并，不发布新版。配置须进入默认分支后才启用；本 PR 不代表定时机器人已实际运行。
.github/build-toolsnpm 构建／发布工具dependencies；内部维护是否添加skip-changelog由审阅判断，不自动隐藏所有依赖或安全变更。保留现有配对版本／SHA／镜像守卫，不能为机器人 PR 变绿盲目放宽测试。已验证
npm test：2,679 通过、2 跳过、0 失败。allow_auto_merge=false、已有安全更新启用、必需检查仍为 Node Tests / UI Test / Release Package。未更改这些设置。52aa0aac236360776fce8948007d7a6e57cb101f的 新 CI 全部通过：Node Tests、四个完整 UI 分片、UI Test 汇总和 Release Package。远端 Linux Node 为 2,678 通过／3 跳过；额外跳过项为仅限 macOS 的 IPC 路径测试，两套依赖审计均为零漏洞。仍不声称已运行真实定时升级、原生实例验收或注册表发布。Summary
Configure three weekly Dependabot version-update scopes (root npm, build-tool npm and GitHub Actions), staggered Sunday morning in Asia/Shanghai. Cap ordinary PRs at two per scope and group minor/patch proposals. Keep major and sensitive Axe/VS Code API proposals individual without ignoring security fixes or changing security-update scheduling.
No package/lock/runtime/workflow changes, automatic merge or new-release publication. Preserve existing compatibility/pin guards and human review. This configuration becomes active only on the default branch; real scheduling/generated-PR behavior must be verified after activation. Existing delivery recovery for previously published releases is unchanged.
Linked issues
None. Follow-up configuration after #135; no claim to fix #99, #128 or the deferred Axe accessibility findings.
Type of change
Visual design
N/A — no production UI changes.
User-facing release note
N/A — internal dependency-maintenance configuration;
skip-changelog. No release requested.How was this tested?
Red/green policy tests; 30 focused checks; full Node suite (2,679 passed, 2 skipped); actual Ruby YAML parsing; negative policy mutations and CRLF equivalence. Independent read-only semantic/workflow-safety assessment found no blockers. Existing required CI remains enabled without bot exclusions.
Sunday delta also passed red/green checks (the old Monday schedule fails; regression to Monday is rejected), 30 focused checks, full local Node tests (2,679 passed, 2 skipped) and actual YAML parsing. Fresh CI for final head
52aa0aac236360776fce8948007d7a6e57cb101fpassed Node Tests, all four full Linux UI shards, UI Test and Release Package. Hosted Linux Node results were 2,678 passed, 3 skipped, 0 failed (the additional skip is a macOS-only IPC test); both dependency audits reported zero vulnerabilities. No new dependency or parser library was installed. No real Dependabot scheduler/update job, F5, daily-instance installation, source-log ingestion or registry publication was run or claimed. All local checks use repository configuration and synthetic fixtures only.Checklist
🤖 Generated by OpenAI Codex as an automated first pass — not a maintainer decision.