ci: Fix Dependabot pub paths and pin GitHub Action#3804
Merged
Conversation
Dependabot's pub entries pointed at /dart, /flutter, etc., but packages were moved under packages/ after the config was added (#1670). Every pub directory therefore resolved to a path that does not exist, so no pub dependency updates were ever opened. Replace the per-package entries with a /packages/* glob so all current packages (and any future ones) are covered and the config cannot silently rot when packages move. Add a bundler ecosystem for the two committed Gemfiles, and pin the one remaining unpinned GitHub Action to a full commit SHA. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Contributor
Semver Impact of This PR⚪ None (no version bump detected) 📋 Changelog PreviewThis is how your changes will appear in the changelog. FeaturesDart
Enhancements
DependenciesDeps
Internal Changes
🤖 This preview updates automatically when you update the PR. |
Contributor
There was a problem hiding this comment.
Pull request overview
Updates repo automation config to restore and broaden Dependabot coverage for Dart/Flutter packages after the monorepo moved under packages/, and to improve supply-chain safety by SHA-pinning a previously tag-pinned GitHub Action.
Changes:
- Replace per-package Dependabot
pubentries with a single multi-directory config covering/packages/*and raise the PR limit. - Add Dependabot
bundlerupdates for the two committedGemfilelocations. - SHA-pin
getsentry/release-comment-issues-gh-actionto the commit behindv1.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
.github/workflows/release-comment-issues.yml |
Pins the release-comment Action to the exact v1 commit SHA. |
.github/dependabot.yml |
Fixes/expands Dependabot update coverage for pub, github-actions, and bundler across the monorepo. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
denrase
approved these changes
Jun 30, 2026
This was referenced Jul 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot's pub entries pointed at
/dart,/flutter, etc., but packages moved underpackages/after the config was added (#1670), so those paths no longer exist and no pub updates have been opened since. Several integration packages were never listed at all.Replaces the per-package entries with a
/packages/*glob so every current and future package is covered. Also adds abundlerentry for the two committedGemfiles and SHA-pins the last unpinned Action (getsentry/release-comment-issues-gh-action→52e0802).Part of the mobile SDK dependency-pinning audit. Out of scope: the unpinned
isar_flutter_libsgit dep in the Flutter example, and adding a CI audit gate.