Conversation
chore(repo): sync `main` with `dev`
… reads (#2079) Dependabot reads dependabot.yml from the DEFAULT branch; target-branch: dev only aims the PRs at dev. Every config fix of the last month therefore never took effect: it landed on dev (#2070 removed the nonexistent automerge-candidate label and gave the named groups update-types; #2078 added the react-doctor ignore) while dependabot kept executing main's stale copy - which is why the recreated #2075 still bumps react-doctor 0.9.5 past the ignore and still tries to apply the automerge-candidate label. This copies dev's dependabot.yml to main verbatim, so the file is identical on both branches and the eventual dev -> main promotion cannot conflict on it. Co-authored-by: Ankit Upadhyay <ankit@dunexploration.com>
…anch rule (#2087) * docs(ci): note that dependabot.yml only takes effect from main Byte-identical to the dev copy (PR #2085). Landing this edit on main also triggers dependabot's immediate version-update check, which recreates the minor-and-patch batch PR it closed after the #2079 config change. * ci(repo): freeze react-doctor for dependabot entirely - even patches red the gate Byte-identical to the dev copy. See the twin commit on ci/dependabot-config-note. --------- Co-authored-by: Ankit Upadhyay <ankit@dunexploration.com>
…in too (#2091) Twin of the dev-side change in the #2088 batch branch, byte-identical file. Dependabot reads this config from main; without this, next week's batch would re-carry react-native 0.81 -> 0.86 and re-break mobile. See the batch commit for the full reasoning. Co-authored-by: Ankit Upadhyay <ankit@dunexploration.com>
…y majors until node 22 (#2122) Co-authored-by: Ankit Upadhyay <ankit@dunexploration.com>
…until node 22 (#2127) Co-authored-by: Ankit Upadhyay <ankit@dunexploration.com>
…2128) Co-authored-by: Ankit Upadhyay <ankit@dunexploration.com>
chore(repo): promote dev to main - Sonar sweep, react-hooks 7, supply chain, dependency overhaul
chore(repo): promote dev to main - sonar branch alignment and exception guard hardening
Bumps the bundler group with 1 update in the /apps/mobileAppYC directory: [json](https://github.com/ruby/json). Updates `json` from 2.20.0 to 2.21.2 - [Release notes](https://github.com/ruby/json/releases) - [Changelog](https://github.com/ruby/json/blob/master/CHANGES.md) - [Commits](ruby/json@v2.20.0...v2.21.2) --- updated-dependencies: - dependency-name: json dependency-version: 2.21.2 dependency-type: direct:production dependency-group: bundler ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
chore(repo): promote dev to main - security sweep, TLS monitor, and the main-merge guard
chore(repo): promote dev to main - nanoid and uuid advisory fixes, platform performance sweep
chore(repo): promote dev to main - clear the code scanning backlog
chore(repo): promote dev to main
fix(repo): promote the bullmq boot and search fixes to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
chore(repo): promote dev to main
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
4 tasks
ankit-yc
pushed a commit
that referenced
this pull request
Aug 25, 2026
#2503, the back-merge this workflow should have opened, failed 'Validate commit messages' on: chore(deps): bump json (#2131) scope must be one of [backend, frontend, ...] [scope-enum] Scope 'deps' is not in the enum. That is the Dependabot commit merged straight into main on 2026-08-13 - the incident that made back-merges necessary in the first place - so the back-merge fails on the very commit it exists to carry back. The job already exempts the promotion direction for this exact reason: a dev to main pull request replays already-merged history and re-lints commits that shipped long ago and cannot be rewritten. A back-merge is the same thing in the opposite direction and was simply not covered. Exempt base dev + head main symmetrically. Verified the condition still distinguishes all four directions: promotion skips, back-merge skips, an ordinary branch into dev or main still lints, and the dependabot exemption is unchanged. Refs #2393
ankit-yc
added a commit
that referenced
this pull request
Aug 25, 2026
…equest (#2504) * ci(repo): let the back-merge report why it cannot open its own pull request The first real run of back-merge.yml failed on the #2483 promotion with: pull request create failed: GraphQL: GitHub Actions is not permitted to create or approve pull requests (createPullRequest) My mistake. The job carries pull-requests: write, but that is overridden by 'Allow GitHub Actions to create and approve pull requests', which is off at both repository and organisation level. I verified the workflow's LOGIC against the real repository state and never verified the one thing it exists to do, which is that its token can actually open a pull request. That setting should stay off. It also lets a workflow APPROVE pull requests, so turning it on to fix a back-merge would open a larger hole than the one this job closes. So take a token if one is offered and explain the situation when it is not: - prefer BACKMERGE_TOKEN when the secret exists, falling back to GITHUB_TOKEN, and print which one is in use so a silent fallback is visible - on the specific refusal, print what is wrong, why the obvious setting change is the wrong answer, and the exact command to open it by hand - on any OTHER failure, report the real error rather than blaming the setting Exercised all four paths against a stubbed gh: refusal exits 1 with the guidance, an unrelated failure exits 1 with its own message and does not mention settings, success with a PAT exits 0, and the already-holds no-op is what the live run did. #2503 carries the back-merge this run should have opened. Refs #2393 * ci(repo): do not re-lint main's history on a back-merge pull request #2503, the back-merge this workflow should have opened, failed 'Validate commit messages' on: chore(deps): bump json (#2131) scope must be one of [backend, frontend, ...] [scope-enum] Scope 'deps' is not in the enum. That is the Dependabot commit merged straight into main on 2026-08-13 - the incident that made back-merges necessary in the first place - so the back-merge fails on the very commit it exists to carry back. The job already exempts the promotion direction for this exact reason: a dev to main pull request replays already-merged history and re-lints commits that shipped long ago and cannot be rewritten. A back-merge is the same thing in the opposite direction and was simply not covered. Exempt base dev + head main symmetrically. Verified the condition still distinguishes all four directions: promotion skips, back-merge skips, an ordinary branch into dev or main still lints, and the dependabot exemption is unchanged. Refs #2393 --------- Co-authored-by: Ankit Upadhyay <ankit@dunexploration.com>
Contributor
Author
|
Merging with admin bypass, deliberately. Recording why. Two checks are red and neither is about this pull request's content:
This pull request has no content. GitHub reports Merged with a MERGE COMMIT, never a squash - a squash creates a new commit and leaves the ancestry broken, which is the problem this exists to fix. |
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Restores the invariant that
devcontainsmain.maincurrently holds 41 commitsdevdoes not. The file diff is empty - they are the merge commits created by eachdevtomainpromotion, which live only onmainand are never carried back. Merging this restores ancestry and changes no files.That matters because
git merge-base --is-ancestor main devis the natural way to ask "is everything promoted?", and while this is unfixed it can never pass. A harmless promotion merge commit and a hotfix that never came back look identical, which is exactly how thejsonsecurity bump (#2131) leftdevon the vulnerable version with nothing detecting it.Opened by hand because
back-merge.ymlcould not do it:GITHUB_TOKENis refused with "GitHub Actions is not permitted to create or approve pull requests", sincecan_approve_pull_request_reviewsisfalseat both repo and org level. That setting should stay off - it also lets a workflow approve pull requests. The workflow is being changed to detect this and report it rather than fail on a raw GraphQL error.Merge with a merge commit. Do not squash: squashing creates a new commit and leaves the ancestry broken, which is the problem this exists to fix.