This is an automated email from the ASF dual-hosted git repository.
ramanathan1504 pushed a commit to branch 2.x
in repository https://gitbox.apache.org/repos/asf/logging-log4j2.git
The following commit(s) were added to refs/heads/2.x by this push:
new 3711ee3f6a Add Dependabot configuration for `2.25.x` and rename update
groups (#4284)
3711ee3f6a is described below
commit 3711ee3f6a53b4ab4f797e1ba22fe2008542dbc1
Author: Piotr P. Karwasz <[email protected]>
AuthorDate: Thu Sep 3 13:25:44 2026 +0200
Add Dependabot configuration for `2.25.x` and rename update groups (#4284)
* Add Dependabot configuration for `2.25.x` and rename update groups
- Add a patch-only Maven entry for the `2.25.x` LTS branch. It uses a
`yearly` schedule as a placeholder: updates are triggered manually.
- Rename all update groups to `<ecosystem>-<level>-<branch>`, so that the
target branch is visible in the title of Dependabot PRs.
* Derive the Dependabot changelog path from the PR base branch
The `Dependabot Process PR` workflow runs from the default branch for
PRs against every branch, so the changelog directory must depend on the
base branch of the PR that triggered it: `.3.x.x` for `main` and
`.2.x.x` for the 2.x branches.
---
.github/dependabot.yaml | 45 +++++++++++++++++++++++++------
.github/workflows/process-dependabot.yaml | 10 +++++--
2 files changed, 45 insertions(+), 10 deletions(-)
diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index 31bb293a59..721913acef 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -57,7 +57,8 @@ updates:
groups:
# Groups all non-major updates in a single PR.
# No group matches major updates, so each one gets a separate PR.
- maven-minor-updates:
+ # "Bump the maven-minor-2.x group across N directories with M updates"
+ maven-minor-2.x:
update-types: [ "minor", "patch" ]
target-branch: "2.x"
registries:
@@ -162,7 +163,8 @@ updates:
groups:
# Groups all non-major updates in a single PR.
# No group matches major updates, so each one gets a separate PR.
- maven-minor-updates:
+ # "Bump the maven-minor-2.x group in /log4j-mongodb4 with M updates"
+ maven-minor-2.x:
update-types: [ "minor", "patch" ]
target-branch: "2.x"
registries:
@@ -177,10 +179,34 @@ updates:
schedule:
interval: "monthly"
groups:
- dependencies:
+ # "Bump the actions-all-2.x group with M updates"
+ actions-all-2.x:
patterns: [ "*" ]
target-branch: "2.x"
+ # The `2.25.x` LTS branch only receives patch-level Maven updates.
+ # Dependabot is not expected to run on its own here: the `yearly` schedule
is a placeholder
+ # and updates are triggered manually from the "Dependabot" tab of the
"Insights" page.
+ - package-ecosystem: maven
+ directory: "/"
+ schedule:
+ interval: "yearly"
+ cooldown:
+ default-days: 7
+ groups:
+ # "Bump the maven-patch-2.25.x group across N directories with M updates"
+ maven-patch-2.25.x:
+ patterns: [ "*" ]
+ target-branch: "2.25.x"
+ registries:
+ - maven-central
+ ignore:
+ # Only allow patch-level upgrades on this maintenance branch
+ - dependency-name: "*"
+ update-types:
+ - "version-update:semver-major"
+ - "version-update:semver-minor"
+
# The `2.26.x` maintenance branch only receives patch-level Maven updates.
- package-ecosystem: maven
directory: "/"
@@ -189,8 +215,8 @@ updates:
cooldown:
default-days: 7
groups:
- # "Bump the Maven patch updates group across N directories with M
updates"
- Maven patch updates:
+ # "Bump the maven-patch-2.26.x group across N directories with M updates"
+ maven-patch-2.26.x:
patterns: [ "*" ]
target-branch: "2.26.x"
registries:
@@ -211,7 +237,8 @@ updates:
groups:
# Groups all non-major updates in a single PR.
# No group matches major updates, so each one gets a separate PR.
- maven-minor-updates:
+ # "Bump the maven-minor-main group across N directories with M updates"
+ maven-minor-main:
update-types: [ "minor", "patch" ]
target-branch: "main"
registries:
@@ -250,7 +277,8 @@ updates:
schedule:
interval: "monthly"
groups:
- dependencies:
+ # "Bump the actions-all-main group with M updates"
+ actions-all-main:
patterns: [ "*" ]
target-branch: "main"
@@ -259,6 +287,7 @@ updates:
schedule:
interval: "monthly"
groups:
- dependencies:
+ # "Bump the npm-all-main group with M updates"
+ npm-all-main:
patterns: [ "*" ]
target-branch: "main"
diff --git a/.github/workflows/process-dependabot.yaml
b/.github/workflows/process-dependabot.yaml
index d67dfbdebd..9cc5c48146 100644
--- a/.github/workflows/process-dependabot.yaml
+++ b/.github/workflows/process-dependabot.yaml
@@ -44,5 +44,11 @@ jobs:
# Convert the PR into draft
pull-requests: write
with:
- # The path to the changelog directory for the current development branch.
- changelog-path: src/changelog/.2.x.x
+ # The path to the changelog directory of the branch targeted by the PR.
+ # This workflow runs from the default branch for PRs against *every*
branch,
+ # so the path is derived from the base branch of the PR that triggered
it.
+ changelog-path: ${{
+ github.event.workflow_run.pull_requests[0].base.ref == 'main'
+ && 'src/changelog/.3.x.x'
+ || 'src/changelog/.2.x.x'
+ }}
