ci(deps): stop proposing okhttp alone, keep the test harness together - #128
Open
albertrodriguezdev wants to merge 1 commit into
Open
albertrodriguezdev wants to merge 1 commit into
albertrodriguezdev wants to merge 1 commit into
Conversation
Two rules, both learned from the first batch of Dependabot pull requests. okhttp and logging-interceptor are ignored because they are not ours to choose: the generated OpenAPI client is built against whatever version openapi-generator emits. Proposed on their own, #122 failed to compile because okhttp 5 moved okhttp3.Call, and #121 was worse for passing -- green and mergeable while leaving the two halves of the same library on different majors. They move when the generator moves. maven-surefire-plugin, maven-failsafe-plugin and junit-bom get their own group that allows majors, because failsafe carries its own provider, surefire-junit-platform, which pins the JUnit Platform version it needs for itself. When junit-bom does not cover that version, two Platform versions coexist in one run and discovery fails with "Tests run: 0" and nothing in the compile output to point at it. That is what broke #120, and it took a run against the real cluster to find. Split apart, these produce a pull request that compiles but cannot find its own tests -- harder to spot than a build failure, which is why majors are grouped here rather than arriving alone. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two Dependabot rules, both learned from what the first batch of its pull requests did.
ignorefor the okhttp pairokhttpandlogging-interceptorare not ours to choose: the generated OpenAPI client is built against whatever versionopenapi-generatoremits.okhttp3.Call.Both are now closed. They should move when the generator moves, not on their own.
A group for
surefire+failsafe+junit-bommaven-failsafe-plugincarries its own provider,surefire-junit-platform, which pins the JUnit Platform version it needs for itself. Whenjunit-bomdoes not cover that version, two Platform versions coexist in the same run and test discovery fails withTests run: 0— with nothing in the compile output pointing at the cause.That is exactly what broke #120, and finding it took a run against the real cluster. Majors are allowed inside this group on purpose: split apart, these three produce a pull request that compiles but cannot find its own tests, which is harder to spot than a build failure.
Note on verification
This file cannot be exercised by CI — Dependabot only reads its configuration from the default branch. The effect is visible on the next Dependabot run after merge, and any config error would surface under Insights → Dependency graph → Dependabot.
🤖 Generated with Claude Code