amaechler opened a new pull request, #20733: URL: https://github.com/apache/druid/pull/20733
Part of #20732. ### Description Dependabot currently opens one Maven PR per artifact every day. Over the 13 weeks to 2026-10-22, that was 381 of the 696 commits on master, and each PR runs the full CI. This PR implements the Dependabot part of the proposal discussed on dev@: https://lists.apache.org/thread/7y1bkvbb6og394mph4lx2x35dktv38nk. Changes to `.github/dependabot.yml`: - **Maven schedule:** weekly (Dependabot's default day is Monday) instead of daily. The 14-day cooldown is unchanged. - **Maven grouping:** a new `maven-minor-patch` group puts all minor and patch updates into one PR. Major updates match no group, so each still gets its own PR. The existing `maven-resolver` group comes first and keeps all of its updates, majors included, together. - **Security updates:** grouped per ecosystem (`maven-security`, `website-security`, `web-console-security`, `github-actions-security`), so a burst of advisories opens one PR per ecosystem instead of one per advisory. Security updates are not bound by the schedule or the cooldown ([options reference](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference)), so they still open whenever GitHub raises an alert. `com.github.luben:zstd-jni` is kept out of the Maven security group because of its known decoding regression, so a security fix for it would not hold up the others. The same `exclude-patterns` list is the way to split out any other security fix that needs code changes. The ignore rules and the `commit-message` settings from #20691 are unchanged. The GitHub Actions entry only gains its security group. #### Reviewing the weekly PR Not every library follows semantic versioning, so a minor or patch update can still break something. When one does, add an `ignore` entry for it to `.github/dependabot.yml` with the breaking version in `versions` (for example `versions: ["2.3.0"]`) and a comment saying why. Dependabot then leaves that version out of the group but still proposes later ones; an entry without `versions` would block the dependency for good. The breaking update itself is then done by hand in its own PR. Keeping the exclusion in the file, rather than using `@dependabot ignore` comments, makes it visible to everyone. Dependabot stops rebasing a PR once someone else pushes to it (for example a `licenses.yaml` fix), so it is best to merge the weekly PR before the next weekly run. Once the first grouped PR is open, any single-artifact Maven PRs left over from the daily schedule can be closed. #### Expected effect Replaying the merged Dependabot bumps from 2026-07-22 to 2026-10-22 against these rules gives about 68 PRs instead of 381, 43 of them majors from the August catch-up. For the last seven weeks of that period, it is 17 PRs instead of 117. This is an estimate: it groups by merge week and ignores Dependabot's own timing and rebases. The grouped PR will still fail the license check whenever it bumps a shipped dependency, since `licenses.yaml` pins exact versions. That becomes one `licenses.yaml` edit per week instead of one per PR; the tracking issue covers making that check version-tolerant. <hr> This PR has: - [x] been self-reviewed. - [x] added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
