chore: merge dev into main - #132
Merged
Merged
Conversation
Runtime dependency bumps now use fix so release-please cuts a patch release and they reach production; development dependencies stay non-releasing.
Adopts the baseline from TitusKirch/scaffold: a long deny list covering anything that wrecks the OS, tears down remote state or destroys work with no recovery path, and a short allow list for read-only git, the search primitives and the project's own check scripts. Ordinary local development is deliberately left to prompt rather than blocked.
Mirrors .claude/settings.json for Codex: the same block list of commands that wreck the machine, tear down remote state or destroy work with no recovery path. Ordinary local development is left to prompt rather than blocked. Permission config is not portable between agents, so both files have to be kept in step.
enhancement and triage were never real labels, so feature issues landed unlabeled. feature and needs triage exist in the shared catalog.
config.yml now points the low-friction, unconfirmed reports at the repo's Discord forum; question.yml is dropped since the forum covers questions.
The checklist asked about checks, docs and commits but never about tests. The stack-specific commands already in the list are left as they are.
merge was false, so merge-deps could only ever triage and report. What a merge actually rests on here is the verify gate, not CI — a Dependabot PR into an integration branch often triggers nothing relevant — and this repo's gate covers it. Grouped minor+patch updates may now merge on the standing opt-in; majors still wait for a human, since confirm defaults to "major". Drops verify, confirm and cap from the block. All three restated a default: mergeDeps.verify falls back to the root verify key and was byte-identical to it, confirm defaults to "major", cap to 5. A restated default carries no information and can only drift away from the thing it copied.
Every update block sets `target-branch`, and that switches off `labels` and `commit-message` for security updates: those always target the default branch and fall back to Dependabot's own defaults, arriving with a bare `go`/`javascript` label instead of the catalog's `stack: *` one. Re-declare each ecosystem without `target-branch` and with `open-pull-requests-limit: 0`, which restricts the new blocks to security updates — version updates stay with the blocks above, and security updates are exempt from that limit.
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
TitusKirch
marked this pull request as ready for review
July 30, 2026 21:14
Repo tabs sized themselves to the full repo name, so a name too long for the strip wrapped onto two or three lines: the tabs ended up at different heights and the bar stopped reading as a row of tabs. The label now caps at a fixed width and ellipsises, and the strip yields space rather than forcing the header wider — which also keeps the header's action buttons from being pushed out of view once the tabs no longer fit. The full name stays reachable through a tooltip, shown only when the name is actually clipped, so hovering a tab on the way to clicking it stays quiet. Refs #133
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated rollup PR for changes accumulated on
dev. Mark ready when you want release-please to pick it up — and use a merge commit, not squash, so individualfeat:/fix:commits stay visible to release-please.