OCPNETUI-65: Add multi-branch dependabot config

[rszwajko]

For main branch:

1. in npm package system aggregate all updates in one PR (per branch). Include only minor and patch updates (both version and security).
2. in github actions package system aggregate all updates in one PR. Include all version updates (including major). Only main branch is supported as older branches have no github actions.
3. ignore shared modules provided (currently) by Console. Unused modules are ignored.

For release branches:

1. update not only patch but also minor versions - reasoning is that: a) usually the latest minor version is the only version that receives security updates b) minor version should not contain breaking changes
2. ignore list is limited to dynamic SDK packages which is only a subset of all shared modules. The remaining packages follow the regular dependency update process - reasoning is that: a) production code is unchanged and minor and patch versions should be backwards compatible b) the Console is updating their deps in parallel so an up-to-date cluster may be close to our versions c) shorter ignore list is more readable - note that dependabot does not support yml aliases (yet) d) the shared modules list changed in time and would require different ignore lists per branch

Note:

1. dependabot provides security updates only on default branch, however patch updates should address most of the security issues.
2. dependency-type "all" covers also transitive dependencies although the docs do not list npm as supported package manager
3. updates for release branches use custom commit message prefix

Reference-Url: https://github.com/openshift/console/blob/c46e0aabe4c9cf330f1e56ad323076e7e8e7f7d8/frontend/packages/console-dynamic-plugin-sdk/src/shared-modules/shared-modules-meta.ts#L41
Reference-Url: dependabot/dependabot-core#1582

Summary by CodeRabbit

• Chores
  • Added automated monitoring for GitHub Actions and npm dependencies.
  • Configured scheduled dependency update checks with cooldown periods and grouped pull requests.
  • Enabled update management across the main branch and supported release branches.
  • Limited updates to approved minor and patch versions while excluding selected pinned, dynamically managed, and platform-provided dependencies.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@rszwajko: This pull request references OCPNETUI-65 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the sub-task to target the "5.1.0" version, but no target version was set.

Details

In response to this:

For main branch:

1. in npm package system aggregate all updates in one PR (per branch). Include only minor and patch updates (both version and security).
2. in github actions package system aggregate all updates in one PR. Include all version updates (including major). Only main branch is supported as older branches have no github actions.
3. ignore shared modules provided (currently) by Console. Unused modules are ignored.

For release branches:

1. update not only patch but also minor versions - reasoning is that: a) usually the latest minor version is the only version that receives security updates b) minor version should not contain breaking changes
2. ignore list is limited to dynamic SDK packages which is only a subset of all shared modules. The remaining packages follow the regular dependency update process - reasoning is that: a) production code is unchanged and minor and patch versions should be backwards compatible b) the Console is updating their deps in parallel so an up-to-date cluster may be close to our versions c) shorter ignore list is more readable - note that dependabot does not support yml aliases (yet) d) the shared modules list changed in time and would require different ignore lists per branch

Note:

1. dependabot provides security updates only on default branch, however patch updates should address most of the security issues.
2. dependency-type "all" covers also transitive dependencies although the docs do not list npm as supported package manager
3. updates for release branches use custom commit message prefix

Reference-Url: https://github.com/openshift/console/blob/c46e0aabe4c9cf330f1e56ad323076e7e8e7f7d8/frontend/packages/console-dynamic-plugin-sdk/src/shared-modules/shared-modules-meta.ts#L41
Reference-Url: dependabot/dependabot-core#1582

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 1a0c7e9b-553e-4eb7-9f50-d79ef0691be6

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 0d601b95-4185-4895-9724-3f7f04382f11

📥 Commits

Reviewing files that changed from the base of the PR and between fff5541 and 7a0f5bb.

📒 Files selected for processing (1)

• .github/dependabot.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

Added Dependabot configuration for monthly GitHub Actions updates and weekly npm updates on the main and release branches. The configuration defines cooldowns, update limits, dependency exclusions, grouping, and branch-specific commit prefixes.

Changes

Dependabot policies

Layer / File(s)	Summary
GitHub Actions update policy .github/dependabot.yml	Adds monthly grouped GitHub Actions updates with a five-day cooldown. Docker updates remain commented out.
Main-branch npm policy .github/dependabot.yml	Adds weekly npm updates with minor and patch limits, exclusions, a five-day cooldown, and separate regular and security groups.
Release-branch npm policies .github/dependabot.yml	Adds equivalent weekly npm policies for release branches 4.23 through 4.18, with branch-specific commit prefixes and dynamic SDK exclusions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 7a0f5

This adds scheduled, grouped Dependabot policies for main and supported release branches. No current merge-blocking risk is identified.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the addition of a multi-branch Dependabot configuration, which is the main change in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS. The pull request changes only .github/dependabot.yml and adds no Ginkgo tests or test titles. Searches found no It(), Describe(), Context(), or When() usages in the repository. Therefo…
Test Structure And Quality	✅ Passed	PASS: The pull request adds only .github/dependabot.yml (217 lines) and changes no Go or Ginkgo test files. It introduces no It blocks, cluster operations, waits, setup, cleanup, or assertions for…
Microshift Test Compatibility	✅ Passed	PASS: The pull request adds only .github/dependabot.yml. The HEAD^..HEAD diff contains no Go files, Ginkgo tests, or new It, Describe, Context, or When declarations. The MicroShift compati…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request changes only .github/dependabot.yml and adds no Ginkgo e2e tests or test bodies. The SNO compatibility check is therefore not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PASS — The pull request adds only .github/dependabot.yml (217 lines). The change does not add or modify deployment manifests, operator code, controllers, replicas, affinity, topology spread constrai…
Ote Binary Stdout Contract	✅ Passed	PASS — The pull request adds only .github/dependabot.yml, a Dependabot configuration file. The exact commit diff contains no OTE binary source, suite setup, or process-level logging code. The reposi…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request changes only .github/dependabot.yml (+217 lines). It adds no Ginkgo e2e tests or test constructs. The file contains no IPv4 test assumptions or runtime external connectivity r…
No-Weak-Crypto	✅ Passed	The pull request adds only .github/dependabot.yml. The exact diff contains no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom cryptography, or secret/token comparisons. Existing md5 text appears …
Container-Privileges	✅ Passed	PASS. The pull request changes only .github/dependabot.yml, a Dependabot configuration file. The added configuration contains no container or Kubernetes manifest settings and no privileged, `hostP…
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The pull request adds only .github/dependabot.yml. The added file contains Dependabot schedules, dependency names, branch names, comments, and public reference URLs. It adds no logging stateme…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rszwajko

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [rszwajko]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rszwajko]

@pcbailey @sjd78 @ronlavi2412 @avivtur @lkladnit
Tested on my fork - example PRs are here - https://github.com/rszwajko/networking-console-plugin/pulls

[pcbailey]

Why would use 'chores' as the prefix? Our prefix convention for release branch PRs is [release-<version>].

[rszwajko]

The default format used by dependabot for the commit message (which is re-used for PR title) is chores($depType). This is what you see for the main branch. Since we will get 1 PR per branch I wanted to distinguish the release branches somehow. That was the second attempt - check closed PRs on my fork for other attempts i.e. [4.18] Bump ...

Technically we can use any prefix we want so i.e. [release-4.18 is possible. I guess for the main branch we could use empty prefix (needs to be tested). However having different prefix for bot commits has some value for me.

As for other tested possibilities - you can add a custom label so we could create label-per-release branch.

[rszwajko]

@pcbailey
looking at the commit history the convention with prefix [release-X.Y] applies to cherry-picks only.
However if you feel strong about this let me know. Also then propose the convention for PRs on main branch.

[pcbailey]

I've been using the [release-X.Y] for any PRs targeted towards older branches, although backports are definitely the most common. I'm ok with combining that with a string that differentiates it if that works for your use case. Something like [release-X.Y]-maintenance?

[rszwajko]

/test all

[openshift-ci]

@rszwajko: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.