Dependabot is being turned off for this repo, so
`.github/workflows/dependabot_changeset.yml` — which committed a `patch`
changeset to every Dependabot PR that touched a released package's
direct production dependencies — has nothing left to run on, and it goes
away along with the paragraph describing it in `.changeset/README.md`.
No other file referenced the workflow, and nothing about hand-written
changesets changes: `npx changeset` is still the way to add one.
Two follow-ups live outside this diff. The repo has no
`.github/dependabot.yml` (it never did), so the bumps we've been getting
came from GitHub's **Dependabot security updates** toggle — that has to
be switched off in *Settings → Advanced Security* for the PRs to
actually stop. And if "Dependabot Changeset" is listed as a required
check in branch protection, it needs removing there or PRs will wait on
a check that no longer runs; the `VERSION_BUMPER_APPID` /
`VERSION_BUMPER_SECRET` credentials this workflow used are worth
double-checking against the other workflows before revoking.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Dependabot bumps of a direct production dependency of `e2b`, `@e2b/cli`
or `@e2b/python-sdk` need a changeset to reach users, and they kept
merging without one (#1461, #1443). This workflow commits a `patch`
changeset naming every released package the bump touches, and stays out
of the way otherwise — dev-only bumps, transitive-only lockfile bumps,
and pull requests that already carry a hand-written changeset are all
skipped. The push uses the version-bumper App token rather than
`GITHUB_TOKEN`, whose commits do not start workflow runs, so the
required checks would never report on the new head commit and the pull
request would be unmergeable.
For #1461 it would have committed `.changeset/dependabot-1461.md`:
```md
---
'e2b': patch
---
Update the `undici` dependency to 7.28.0.
```
The `changes` job now skips the Dependabot metadata lookup once a
changeset is on the branch, so the workflow's own commit never sends
`fetch-metadata` looking for metadata on a pull request that is no
longer all-Dependabot commits, and `dorny/paths-filter` is SHA-pinned as
the one third-party action this trigger reaches.
Verified by running the commit step against a scratch repository with
the exact expression outputs for single-package, grouped multi-package
and Python-only bumps, then parsing each result with changesets' own
`@changesets/parse`. Two things to watch on the first live run: the
org-level `verification/cla-signed` check has to accept the App's
commit, and adding a commit stops Dependabot auto-rebasing the branch
(`@dependabot rebase` still works, and the workflow rewrites the
changeset afterwards).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
SDK-311
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Mish Ushakov