chore(deps): bump supabase/sdk/.github/workflows/sync-sdk-compliance.yml from 1.1.1 to 1.2.0 - #1755
Merged
spydon merged 1 commit intoAug 24, 2026
Conversation
Bumps [supabase/sdk/.github/workflows/sync-sdk-compliance.yml](https://github.com/supabase/sdk) from 1.1.1 to 1.2.0. - [Release notes](https://github.com/supabase/sdk/releases) - [Changelog](https://github.com/supabase/sdk/blob/main/CHANGELOG.md) - [Commits](supabase/sdk@63c1ac1...29e402d) --- updated-dependencies: - dependency-name: supabase/sdk/.github/workflows/sync-sdk-compliance.yml dependency-version: 1.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
spydon
approved these changes
Aug 24, 2026
spydon
deleted the
dependabot/github_actions/supabase/sdk/dot-github/workflows/sync-sdk-compliance.yml-1.2.0
branch
August 24, 2026 09:02
spydon
added a commit
that referenced
this pull request
Aug 25, 2026
…1757) ## What Replaces the mostly ungrouped `github-actions` Dependabot config with four groups: | Group | Pattern | Purpose | | --- | --- | --- | | `codeql-action` | `github/codeql-action*` | Pre-existing. `init` and `analyze` must run the same version. | | `supabase-sdk-workflows` | `supabase/sdk*` | New. Reusable workflows sharing one repository's release tags. | | `supabase-actions-workflows` | `supabase/actions*` | New. Same, for the three workflows pinned to one commit. | | `actions-minor-patch` | `*` (minor, patch) | New. Batches every remaining non-breaking bump. | Group order matters: Dependabot assigns each dependency to the first group it matches, so the three specific groups are listed before the catch-all. ## Why **Lockstep dependencies were being split.** Dependabot treats each reusable workflow as its own dependency, named by its full path. The `supabase/sdk` v1.1.1 to v1.2.0 bump therefore arrived as two pull requests, #1755 and #1756, and between the two merges the repository had two callers pointing at different releases of the same source. `supabase/actions` has the same exposure but larger: three reusable workflows in `stale.yml`, `label-issues.yml` and `block-merge.yml`, all pinned to commit `2e898cb`, so its first bump would have landed as three separate pull requests. **Volume.** Ten individual bump pull requests merged across 2026-08-12 and 2026-08-13, five on each day. The catch-all collapses that into roughly one per week. ## Deliberately not grouped Major bumps match no group and keep arriving as individual pull requests. A bump like the earlier `actions/upload-artifact` 4.6.2 to 7.0.1 should be reviewed and revertable on its own rather than buried in a batch. ## Verification - `.github/dependabot.yml` parses, and the four groups resolve in the intended order. - Confirmed the existing `codeql-action` group is already working: `codeql.yml:41` and `codeql.yml:47` are both pinned to `ff2f1c62` at v4.37.7. Past bump titles name only `analyze` because Dependabot titles a group after a single member when only that member moved. - Audited all 19 `uses:` references across `.github/workflows/`. Apart from the three groups above, no remaining action is coupled to another. ## Note Grouping takes effect on the next Dependabot run. Both #1755 and #1756 have since been merged, and `supabase/sdk` is back in sync at v1.2.0 in both callers, so nothing needs recreating. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Configured automated updates to group reusable workflow dependencies by repository. * Grouped minor and patch updates for GitHub Actions, while keeping major updates separate for review. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps supabase/sdk/.github/workflows/sync-sdk-compliance.yml from 1.1.1 to 1.2.0.
Release notes
Sourced from supabase/sdk/.github/workflows/sync-sdk-compliance.yml's releases.
Changelog
Sourced from supabase/sdk/.github/workflows/sync-sdk-compliance.yml's changelog.
... (truncated)
Commits
29e402dchore(main): release 1.2.0 (#89)bd6d972feat(auth): add concurrent PKCE flow id capability (#91)ccc2fbbfix(specs): correct third-party auth error propagation behavior (#86)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)