From 3074417d64060c455f93b8561c58e57694c60fac Mon Sep 17 00:00:00 2001 From: RCLL Date: Fri, 28 Aug 2026 16:23:27 +0300 Subject: [PATCH] =?UTF-8?q?chore(ci):=20drop=20dependabot=20=E2=80=94=20th?= =?UTF-8?q?e=20mirror=20deletes=20its=20branches=20before=20they=20can=20l?= =?UTF-8?q?and?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GitHub is a push mirror of the Forgejo canon, not a peer. The sync force-matches refs, so every branch dependabot opens is deleted within the hour and its PR closes itself. Two runs proved it (checkout 4->7 and setup-node 4->7, both opened 2026-08-24, both auto-closed): the loop cannot land a change, and a public repo whose only PRs are self-closed bot PRs reads as abandoned. The bot's one useful output was taken by hand — publish.yml already pins actions/checkout@v7 and actions/setup-node@v7, shipped in 0.1.0. FORK.md records why, so restoring the file is a decision and not an oversight. --- .github/dependabot.yml | 6 ------ FORK.md | 21 +++++++++++++++++++++ 2 files changed, 21 insertions(+), 6 deletions(-) delete mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index 5ace4600..00000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,6 +0,0 @@ -version: 2 -updates: - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" diff --git a/FORK.md b/FORK.md index 7bf82ea3..446bd838 100644 --- a/FORK.md +++ b/FORK.md @@ -122,3 +122,24 @@ upstream https://github.com/vectorize-io/hindsight.git (push URL deliberately and this repository is one decision away from being made public with an already published `server.json` — a rewritten history is a one-way door. The series lives on its own branch; repointing `main` is the owner's call. + +## Dependency updates: why there is no dependabot + +`.github/dependabot.yml` was removed on 2026-08-28. It was not failing — it was +running in a loop that could never land. + +GitHub is a **push mirror** of the Forgejo canon, not a peer. The mirror sync +force-matches refs, so a branch dependabot opens on GitHub is deleted within the +hour and its pull request closes itself. Two runs proved it (`bump +actions/checkout 4 → 7` and `bump actions/setup-node 4 → 7`, both opened +2026-08-24, both auto-closed). A public repository whose only pull requests are +self-closed bot PRs reads as abandoned, which is the opposite of what the bot is +for. + +The bot's one useful output was taken by hand: `.github/workflows/publish.yml` +now pins `actions/checkout@v7` and `actions/setup-node@v7`, and that upgrade +shipped in the 0.1.0 release. + +Action versions are therefore bumped on the canon, by hand, when the workflow is +touched. If GitHub ever becomes the canon rather than a mirror, restore the file +— the loop closes only because pushes are one-way.