chore(ci): dependabot fixes (#11164)
* chore: exclude ancient +incompatible versions from go.mod prevents Dependabot from failing when it tries to update go-ipfs-cmds and go-libp2p directly and resolves to pre-Go-modules v2.x/v6.x versions that reference deleted packages * chore(deps): group opentelemetry, prometheus, and uber packages reduces PR noise by batching related observability dependencies * ci: add workflow to run make mod_tidy on Dependabot PRs ensures all go.mod/go.sum files stay in sync when Dependabot updates dependencies in the root module supports manual dispatch with PR number for existing PRs
Marcin Rataj committed
Jan 23, 2026 at 06:17 UTC
6d253a6b8034a03650e6ab6ea39537946fc6c590
3 files changed
+80
.github/dependabot.yml
+12
@@ -1,3 +1,4 @@
1
+# Dependabot PRs are auto-tidied by .github/workflows/dependabot-tidy.yml
2
version: 2
3
updates:
4
- package-ecosystem: "github-actions"
@@ -26,3 +27,14 @@ updates:
27
golang-x:
28
patterns:
29
- "golang.org/x/*"
30
+ opentelemetry:
31
+ patterns:
32
+ - "go.opentelemetry.io/*"
33
+ prometheus:
34
+ patterns:
35
+ - "github.com/prometheus/*"
36
+ - "contrib.go.opencensus.io/*"
37
+ - "go.opencensus.io"
38
+ uber:
39
+ patterns:
40
+ - "go.uber.org/*"
.github/workflows/dependabot-tidy.yml
new
+61
@@ -0,0 +1,61 @@
1
+# Dependabot only updates go.mod/go.sum in the root module, but this repo has
2
+# multiple Go modules (see docs/examples/). This workflow runs `make mod_tidy`
3
+# on Dependabot PRs to keep all go.sum files in sync, preventing go-check CI
4
+# failures.
5
+name: Dependabot Tidy
6
+
7
+on:
8
+ pull_request_target:
9
+ types: [opened, synchronize]
10
+ workflow_dispatch:
11
+ inputs:
12
+ pr_number:
13
+ description: 'PR number to run mod_tidy on'
14
+ required: true
15
+ type: number
16
+
17
+permissions:
18
+ contents: write
19
+ pull-requests: write
20
+
21
+jobs:
22
+ tidy:
23
+ if: github.actor == 'dependabot[bot]' || github.event_name == 'workflow_dispatch'
24
+ runs-on: ubuntu-latest
25
+ steps:
26
+ - name: Get PR info
27
+ id: pr
28
+ env:
29
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
30
+ run: |
31
+ if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
32
+ pr_number="${{ inputs.pr_number }}"
33
+ else
34
+ pr_number="${{ github.event.pull_request.number }}"
35
+ fi
36
+ echo "number=$pr_number" >> $GITHUB_OUTPUT
37
+ branch=$(gh pr view "$pr_number" --repo "${{ github.repository }}" --json headRefName -q '.headRefName')
38
+ echo "branch=$branch" >> $GITHUB_OUTPUT
39
+ - uses: actions/checkout@v4
40
+ with:
41
+ ref: ${{ steps.pr.outputs.branch }}
42
+ token: ${{ secrets.GITHUB_TOKEN }}
43
+ - uses: actions/setup-go@v5
44
+ with:
45
+ go-version-file: go.mod
46
+ - name: Run make mod_tidy
47
+ run: make mod_tidy
48
+ - name: Check for changes
49
+ id: git-check
50
+ run: |
51
+ if [[ -n $(git status --porcelain) ]]; then
52
+ echo "modified=true" >> $GITHUB_OUTPUT
53
+ fi
54
+ - name: Commit changes
55
+ if: steps.git-check.outputs.modified == 'true'
56
+ run: |
57
+ git config user.name "github-actions[bot]"
58
+ git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
59
+ git add -A
60
+ git commit -m "chore: run make mod_tidy"
61
+ git push
go.mod
+7
@@ -271,3 +271,10 @@ require (
271
gopkg.in/yaml.v3 v3.0.1 // indirect
272
lukechampine.com/blake3 v1.4.1 // indirect
273
)
274
+
275
+// Exclude ancient +incompatible versions that confuse Dependabot.
276
+// These pre-Go-modules versions reference packages that no longer exist.
277
+exclude (
278
+ github.com/ipfs/go-ipfs-cmds v2.0.1+incompatible
279
+ github.com/libp2p/go-libp2p v6.0.23+incompatible
280
+)