From db5e6822ab83d1287fe45f08cf994d75889977e4 Mon Sep 17 00:00:00 2001 From: Lukas Klingsbo Date: Mon, 24 Aug 2026 11:07:32 +0200 Subject: [PATCH 1/2] ci: group supabase/sdk reusable workflow bumps into one dependabot pull request --- .github/dependabot.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e154b606f..aab43cf3b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -11,3 +11,8 @@ updates: codeql-action: patterns: - "github/codeql-action*" + # Every reusable workflow we call from supabase/sdk shares that + # repository's release tags, so they always move in lockstep. + supabase-sdk-workflows: + patterns: + - "supabase/sdk*" From a63031afb09a1aa7b2adcc43cdc47662249172d6 Mon Sep 17 00:00:00 2001 From: Lukas Klingsbo Date: Mon, 24 Aug 2026 11:19:37 +0200 Subject: [PATCH 2/2] ci: group supabase/actions workflows and batch minor and patch action bumps --- .github/dependabot.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index aab43cf3b..22121d0a9 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -16,3 +16,17 @@ updates: supabase-sdk-workflows: patterns: - "supabase/sdk*" + # Same story for the reusable workflows we call from supabase/actions, + # which are all pinned to a single commit of that repository. + supabase-actions-workflows: + patterns: + - "supabase/actions*" + # Everything else that cannot break a workflow on its own, batched into a + # single pull request. Major bumps deliberately match no group so they + # still arrive individually and get reviewed on their own. + actions-minor-patch: + patterns: + - "*" + update-types: + - "minor" + - "patch"