Repository navigation
Conversation
Dependency upgrades are done as one sweeping pass rather than a stream of single-dependency PRs, because each bump otherwise needs the same manual follow-up: regenerating CRDs and RBAC, regenerating dependency_licenses.csv, repairing test fixtures that a Kubernetes API bump invalidates, and writing the artifacthub.io/changes entries that users actually read. The license list and the chart changelogs are the parts that get forgotten. The procedure is written up as an Agent Skill so an assistant can carry it out, and so a human can follow the same checklist. It is markdown only and contains no scripts: it names the make targets to run, in what order, and why, including the traps that are not obvious from the Makefile (a stale untracked vendor/ breaks hack/check_license.sh locally while CI stays green; the Go version gate rejects a newer toolchain as hard as an older one; tool installs are skipped when a stale binary exists in bin/; the license list must be generated with the Linux/amd64 prefix or CI's byte-exact diff fails; the lint sub-targets share a scratch directory and cannot run under make -j). The skill lives in .agents/skills/, the vendor-neutral location read directly by most assistants. Claude Code only discovers skills under .claude/skills/ and has no setting to register another directory, so it needs a local shim. That shim is deliberately not kept in tree: it would mean a hand-maintained duplicate per skill, each with a copy of the frontmatter to keep in sync. Instead .claude/ is gitignored and dev-docs/dependency-upgrades.md describes the local options, recommending a SessionStart hook that mirrors .agents/skills/ into .claude/skills/ on every session. A symlink is documented as the one option to avoid, since Claude Code's skill discovery and validation do not resolve symlinks even though execution does. Also excludes .agents and .claude from the source release tarball, alongside the existing .github and .run exclusions, so agent tooling does not ship in an ASF source release.
Handle major version bumps special Offer to push
Dependabot takes GitHub Actions, "make list-upgrades" detects what the skill owns, and the pins no tool can see are listed for hand-checking.
Hardcoded line numbers go stale silently; patterns report when they stop matching, and printing the matched text shows the current value.
Report failures per section instead of aborting silently, resolve package paths to their module before probing majors, compare versions rather than strings, and correct the Claude Code and -mod=readonly claims in the docs.
It is not a dependency: nothing links kubeVersion to the k8s.io/* libraries, so a sweep must never move it. Report the gap between declared, built and tested instead.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Failed version lookups can incorrectly report envtest assets as current or indicate that no newer major versions exist.
2 open issues
What changed in this PR
This PR splits dependency maintenance between Dependabot for GitHub Actions and a documented agent skill for coordinated application-dependency upgrades.
Changes:
- Configures monthly grouped Actions updates with a seven-day cooldown and ASF approval guidance.
- Adds
make list-upgradesto report module, major-version, tool and envtest updates. - Documents the upgrade workflow and excludes agent configuration from source release bundles.
| File | Description |
|---|---|
Makefile |
Adds the list-upgrades target. |
hack/release/artifacts/bundle_source.sh |
Excludes agent files from source bundles. |
hack/list-upgrades.sh |
Reports available upgrades and manual-check pins. |
dev-docs/dependency-upgrades.md |
Explains upgrade ownership, procedures and assistant setup. |
AGENTS.md |
Points agents to the skill and discovery command. |
.gitignore |
Ignores local Claude configuration. |
.github/dependabot.yml |
Schedules grouped GitHub Actions updates. |
.agents/skills/dependency-upgrade/SKILL.md |
Defines the coordinated dependency-upgrade procedure. |
Review effort: Balanced
Contributor
Author
|
I have just tested the new SKILL on current main, and it will report some findings and put put the resulting dep upgrade PR. Here is an initial screenshot of how it works: |
Contributor
Author
I'm pleased to see that the SKILL is intelligent when writing Changelog entries, and does a reachability analysis to decide correct change type. |
Contributor
Author
|
Cross linking #865 which is the PR the SKILL produced |
Annotate candidates needing a newer Go than go.mod pins, and report a failed successor or envtest lookup as unchecked rather than as nothing-to-do.
This was referenced Oct 24, 2026
…ing a new SKILL sweep
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Over in #855 I started on Dependabot setup for this repo. This PR is a fuller answer: not Dependabot or a skill, but a split by who can actually do the work.
Dependabot owns GitHub Actions.
.github/dependabot.yml— monthly, grouped into one PR, 7-day cooldown. Cheap to review, no follow-up work. This overlaps #855, which can be closed or trimmed to its other ecosystems once this lands.A skill owns the application dependencies. A Go module bump is not self-contained: it needs CRDs and RBAC regenerated,
dependency_licenses.csvrefreshed, the test fixtures a Kubernetes API bump invalidates repaired, and anartifacthub.io/changesentry written. Dependabot can do none of that, so those stay one reviewed sweep. The skill lives in.agents/skills/, the vendor-neutral location most assistants read directly; it is markdown only, no scripts, and a human can follow the same checklist.make list-upgradesanswers "what has moved?" New scripthack/list-upgrades.sh: direct Go modules, new majors, the Makefile's pinned tools and the envtest assets, all read from the Go module proxy — then the image tags and version strings no tool can see, printed as a hand-check list. Read-only, always exits 0, deliberately not part ofmake lint.Run against
maintoday it finds 13 module updates, three stale tool pins, and two majors we are behind: Helm v4 and kustomize v5. Nothing would otherwise have reported those —go list -ucannot see a new major, because under semantic import versioning it is a different module path. Patch and minor bumps are always taken; a major gets a cost assessment and an explicit decision.One thing worth a reviewer's eye: the note in
dependabot.ymlabout the ASF allowlisting actions by commit SHA (apache/infrastructure-actions), which already bit us in #857.