Skip to content

Say how packages get updated when a solution has no Dependabot #67

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stphnwlsh merged 2 commits into from
Nov 8, 2026
Merged

Say how packages get updated when a solution has no Dependabot #67

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
51f0ac2
Say how packages get updated when a solution has no Dependabot
stphnwlsh Nov 8, 2026
b1ba9b1
Merge branch 'main' into fix/dependabot-wording
stphnwlsh Nov 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .agents/skills/docker-and-compose/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ Every port published on the developer's machine, by the compose file or by `laun

1. Keep restore before `COPY . .` so a code change doesn't redo the restore layer. A new project folder needs nothing extra; the loops pick up every `src/*/*.csproj` and `tests/*/*.csproj`.
2. Anything the app writes goes under `/app/data`, the only folder the app user can write to.
3. Pin every image in compose to a version. Dependabot keeps them current.
3. Pin every image in compose to a version, and bump them with the monthly package update (`packages-and-dependencies`).
4. Change base images through the `ARG`s at the top, not inside a `FROM`.
5. Test locally with `docker compose up -d --build`, then hit `/health/ready` and the API reference.

Expand Down
7 changes: 4 additions & 3 deletions .agents/skills/packages-and-dependencies/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
name: packages-and-dependencies
description: How NuGet packages are managed with Central Package Management and monthly grouped Dependabot updates, and which packages are not allowed. Use when adding, updating or removing a package.
description: How NuGet packages are managed with Central Package Management and a monthly update, and which packages are not allowed. Use when adding, updating or removing a package.
metadata:
scope: shared
---
Expand All @@ -9,7 +9,7 @@ metadata:

## The rule

Versions live in one file, `Directory.Packages.props`, and project files only name the package. Dependabot opens one grouped pull request a month (on the 15th) for NuGet, Docker Compose images and GitHub Actions together. Every package must be free and open source, with no paid or commercial licence tier.
Versions live in one file, `Directory.Packages.props`, and project files only name the package. Packages are updated once a month, all together in one pull request. If the repository has `.github/dependabot.yml`, Dependabot opens that pull request. If it doesn't, update by hand: `dotnet list package --outdated` lists what's behind. Every package must be free and open source, with no paid or commercial licence tier.

## Steps

Expand All @@ -25,12 +25,13 @@ Versions live in one file, `Directory.Packages.props`, and project files only na
- Put `Version=` on a `PackageReference`.
- Add MediatR, MassTransit (v9 and later), AutoMapper, FluentAssertions (v8 and later), or any other library that moved to a commercial licence. Use `Mediator`, `Riok.Mapperly` and `Shouldly`.
- Add a package to quiet a warning or save a few lines.
- Update one package by hand between Dependabot runs unless it fixes a vulnerability.
- Update one package on its own between the monthly updates unless it fixes a vulnerability.

## Check

``` bash
dotnet restore
dotnet build
dotnet list package --vulnerable
dotnet list package --outdated
```
Loading