Mish Ushakov
9c555a12aa
Dependabot bumps of a direct production dependency of `e2b`, `@e2b/cli` or `@e2b/python-sdk` need a changeset to reach users, and they kept merging without one (#1461, #1443). This workflow commits a `patch` changeset naming every released package the bump touches, and stays out of the way otherwise — dev-only bumps, transitive-only lockfile bumps, and pull requests that already carry a hand-written changeset are all skipped. The push uses the version-bumper App token rather than `GITHUB_TOKEN`, whose commits do not start workflow runs, so the required checks would never report on the new head commit and the pull request would be unmergeable. For #1461 it would have committed `.changeset/dependabot-1461.md`: ```md --- 'e2b': patch --- Update the `undici` dependency to 7.28.0. ``` The `changes` job now skips the Dependabot metadata lookup once a changeset is on the branch, so the workflow's own commit never sends `fetch-metadata` looking for metadata on a pull request that is no longer all-Dependabot commits, and `dorny/paths-filter` is SHA-pinned as the one third-party action this trigger reaches. Verified by running the commit step against a scratch repository with the exact expression outputs for single-package, grouped multi-package and Python-only bumps, then parsing each result with changesets' own `@changesets/parse`. Two things to watch on the first live run: the org-level `verification/cla-signed` check has to accept the App's commit, and adding a commit stops Dependabot auto-rebasing the branch (`@dependabot rebase` still works, and the workflow rewrites the changeset afterwards). 🤖 Generated with [Claude Code](https://claude.com/claude-code) SDK-311 --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
600 B
600 B
Changesets
To add changeset run:
npx changeset
in the root of the project. This will create a new changeset in the .changeset folder.
Dependabot pull requests get one automatically: .github/workflows/dependabot_changeset.yml
commits a patch changeset for every released package whose direct production dependencies the
bump touches. Dev-only and transitive-only bumps are left alone, and the workflow never overwrites
a changeset that is already on the branch — so edit or replace the generated file whenever the bump
deserves a better description or a larger version step.