ci: point Dependabot at develop instead of main - #690
Merged
Conversation
No target-branch was set on any of the four ecosystems, so all of them defaulted to the repository default branch. Dependency bumps therefore landed straight on main -- released code -- without being built as :beta or running on the dev instance first, which contradicts the branching model in CLAUDE.md where main only moves when a release is merged. It had already drifted: 7366906 (jsdom) sits on main and not on develop. It also routed every bump through the merge queue that exists only on main, which is where #683 and #686 are currently stuck despite being approved with all required checks green.
This was referenced Aug 10, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
.github/dependabot.ymlsets notarget-branchon any of its four ecosystems (nuget, npm, github-actions, docker), so all of them fall back to the repository's default branch —main.That contradicts the branching model in CLAUDE.md:
Every dependency bump has been landing directly on released code without being built as
:beta, without running on the dev instance, and without appearing indevelopfirst.It has already drifted:
7366906(jsdom) is onmainand not ondevelop.There is a second effect. The merge queue (ruleset 20426419) exists only on
main;develophas none. So every Dependabot PR is routed through a queue it does not need — which is where #683 and #686 are stuck right now, both approved with all required checks green and neither ever entering the queue.Change
target-branch: developon all four ecosystems, with a comment recording why.Follow-up (not in this PR)
developon its next run.mainmerged back intodevelopto recover the jsdom bump.