mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-19 05:26:47 +00:00
Maurice
1aa1aea57e
Dependabot cannot be pointed at dev. \ arget-branch\ in dependabot.yml applies to version updates only, and security updates always open against the default branch. Security updates are all this repository gets, since there is no dependabot.yml at all, so every one of them arrives on main. The branch check then labelled them wrong-base-branch and close-stale-wrong-branch shut them 24 hours later. Thirteen of the seventeen Dependabot pull requests died that way; the four that survived were retargeted by hand. The comment the check leaves asks the author to click Edit, which a bot cannot do. So retarget them instead. If that fails, because the branch was cut from main and dev has moved on, it falls through to the existing path so a human sees it rather than the check quietly passing. Note this only takes effect once it is on main: pull_request_target loads the workflow from the pull request's base branch, and these arrive on main.