Skip to content

chore: add dependabot config #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
yakimoto wants to merge 3 commits into
base: main
Choose a base branch
from
Open

chore: add dependabot config #1

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
796f2b9
chore: add dependabot config for example directories
yakimoto Apr 2, 2026
cbdb1be
chore: drop mcp-server-setup from dependabot and add PR limits
yakimoto Aug 12, 2026
6ef1b7a
chore: cover root package.json in dependabot config
yakimoto Aug 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
version: 2
updates:
- package-ecosystem: npm
directory: /
schedule:
interval: weekly
open-pull-requests-limit: 10
- package-ecosystem: npm
directory: /sdk-quickstart
schedule:
interval: weekly
Comment thread
qodo-code-review[bot] marked this conversation as resolved.
open-pull-requests-limit: 10
- package-ecosystem: npm
directory: /adk-hello-agent
schedule:
interval: weekly
Comment on lines +8 to +16

@coderabbitai coderabbitai Bot Apr 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check for workspace configuration in package.json files

echo "=== Checking for npm workspace setup ==="

# Check root package.json for workspaces field
if [ -f package.json ]; then
  echo "Root package.json:"
  cat package.json | jq -r 'if .workspaces then "Workspaces: \(.workspaces)" else "No workspaces field" end'
fi

echo -e "\n=== Checking each directory's package.json ==="
for dir in sdk-quickstart mcp-server-setup adk-hello-agent; do
  if [ -f "$dir/package.json" ]; then
    echo -e "\n$dir/package.json exists"
    cat "$dir/package.json" | jq -r '.name // "no name"' | sed 's/^/  Package name: /'
  else
    echo -e "\n$dir/package.json NOT FOUND"
  fi
done

echo -e "\n=== Checking for lockfiles ==="
fd -t f 'package-lock.json|yarn.lock|pnpm-lock.yaml' -x echo "Found: {}"

Repository: wave-av/examples

Length of output: 430

Remove /mcp-server-setup from Dependabot configuration or add a package.json file to that directory.

The configuration for /mcp-server-setup will not work—Dependabot requires a package.json file in each configured directory to manage dependencies. Only /sdk-quickstart and /adk-hello-agent have package.json files.

To fix:

  1. Either remove the /mcp-server-setup entry from .github/dependabot.yml
  2. Or add a package.json file to /mcp-server-setup if it should have npm dependencies managed

Additionally, consider these improvements for the remaining directories:

  • Add open-pull-requests-limit to prevent excessive simultaneous PRs:
- package-ecosystem: npm
  directory: /sdk-quickstart
  schedule:
    interval: weekly
  open-pull-requests-limit: 10
  • Add grouping rules to batch dependency updates by type and reduce PR noise
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/dependabot.yml around lines 3 - 14, The dependabot config contains
an entry for /mcp-server-setup but that directory lacks a package.json so
Dependabot will fail; either remove the /mcp-server-setup stanza from
.github/dependabot.yml or add a valid package.json to /mcp-server-setup so npm
updates can run, and for the remaining entries (e.g., /sdk-quickstart and
/adk-hello-agent) add an open-pull-requests-limit setting
(open-pull-requests-limit: 10) and optional grouping rules to batch updates by
type to reduce PR noise.

open-pull-requests-limit: 10
Comment thread
devin-ai-integration[bot] marked this conversation as resolved.
Comment on lines +1 to +17

@devin-ai-integration devin-ai-integration Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 No lockfiles present; updates will be manifest-only

The repo contains no package-lock.json/yarn.lock anywhere, so the scheduler will only be able to bump version ranges in the manifests. Since the manifests use caret ranges (e.g. "@wave-av/sdk": "^2.0.0"), most minor/patch releases will not produce any update PR at all — only major bumps will. Worth confirming this matches the intent behind adding the config.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@blacksmith-sh blacksmith-sh Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Informational observation, not a config bug: the repo intentionally has no lockfiles, and manifest-only range bumps are the expected Dependabot behavior here. Adding lockfiles is out of scope for this PR.

Loading