also looking at this

fix(ci): enforce dependency update boundaries

#311

Merged glennmichael123 wants to merge codex/buddy-update-boundaries into main

4 files +163 -28

glennmichael123 9 days ago

Summary

Keep Buddy Bot as the dependency PR generator, with explicit version and exact-package selection before PR creation.
Enforce patch-only, minor-plus-patch, major-only, and all-stable strategies from actual versions, independent of scanner labels.
Preserve SHA/digest pins and ambiguous refs for manual review; rebuild groups after filtering so excluded updates cannot re-enter a PR.
Make dry runs execute the same scanner and guard without creating PRs, and replace the unsupported update --packages invocation.

No dependency versions or framework support ranges change in this PR.

126 script/harness tests passed (440 assertions), including real Buddy Bot regrouping and mocked PR creation.
Pickier, actionlint, and diff checks passed.
Real scanner dry runs in an isolated checkout confirmed package filtering and patch boundaries; checkout remained unchanged and no dependency PRs were created.

4 changed files on the files tab, with 0 review threads.