Repository navigation
chore: replace Dependabot and bump workflow with a Claude Code routine - #278
Merged
Merged
Conversation
- Remove .github/dependabot.yml and .github/workflows/bump-versions.yml; a weekly Claude Code cloud routine now runs `bump` and opens PRs. - bump: skip pins whose current range already admits the target (^ within a major, ^0.x / ~ within a minor) and never propose downgrades. - SECURITY.md: describe manual / govulncheck-driven Go dependency updates. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 27, 2026
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/dependabot.ymland.github/workflows/bump-versions.yml. A weekly Claude Code cloud routine now runsgo run -tags bump . bumpand opens one PR per package.pkg/bump.go: newneedsBumpskips pins whose current range already admits the target (scaffolded projects have no lockfile, so^/~ranges float on install), and never proposes downgrades. Exact pins and^0.0.xalways qualify.SECURITY.md: Go dependency updates are now manual /govulncheck-driven instead of Dependabot.Notes
go.modor GitHub Actions any more. The open Dependabot PRs (chore(deps): bump golang.org/x/mod from 0.41.0 to 0.42.0 #257, chore(deps): bump github.com/charmbracelet/x/ansi from 0.11.8 to 0.11.9 #258, chore(deps): bump charm.land/bubbletea/v2 from 2.0.10 to 2.1.0 #259, chore(deps): bump cycjimmy/semantic-release-action from 6 to 8 #272) and the old workflow's chore: bump package versions #271 need merging or closing by hand.Test plan
go vet ./...(with and without-tags bump)go build(with and without-tags bump)go test ./..., including the newTestNeedsBumptable🤖 Generated with Claude Code