also looking at this
fix(migrate): create the ledger inside the lock, and stop the two bots racing
#1079
4 files
+81
-13
| @@ -0,0 +1,25 @@ | ||
| 1 | # GitHub Actions version bumps only. | |
| 2 | # | |
| 3 | # buddy-bot owns npm dependencies (see CLAUDE.md) and renovate is disabled in | |
| 4 | # .github/renovate.json, but neither covers this: buddy-bot GENERATES workflow | |
| 5 | # files, it does not bump the `uses:` pins inside them. Every actions bump this | |
| 6 | # repo has received came from renovate, so switching renovate off without this | |
| 7 | # would leave `actions/checkout`, `actions/cache` and `oven-sh/setup-bun` to | |
| 8 | # drift until something breaks. | |
| 9 | # | |
| 10 | # Scoped deliberately to github-actions. Adding an npm ecosystem here would | |
| 11 | # recreate the exact problem being fixed — two bots rewriting bun.lock, each | |
| 12 | # invalidating the other's open PRs. | |
| 13 | version: 2 | |
| 14 | updates: | |
| 15 | - package-ecosystem: "github-actions" | |
| 16 | directory: "/" | |
| 17 | schedule: | |
| 18 | interval: "weekly" | |
| 19 | commit-message: | |
| 20 | prefix: "chore(deps)" | |
| 21 | labels: | |
| 22 | - "dependencies" | |
| 23 | # One PR per action. These diffs are a single line and are read at a glance; | |
| 24 | # grouping them only makes a bad bump harder to bisect. | |
| 25 | open-pull-requests-limit: 5 | |