From f2c460f0e854d1e345bd0336090519ff8274f616 Mon Sep 17 00:00:00 2001 From: Stephen Walsh <868017+stphnwlsh@users.noreply.github.com> Date: Sun, 8 Nov 2026 18:00:55 +0000 Subject: [PATCH] Say how packages get updated when a solution has no Dependabot Generated solutions don't ship dependabot.yml, but two shipped skills said Dependabot opens the monthly update and told agents not to update by hand between its runs, so nothing would ever update. The skills now say Dependabot does it when it's set up, and the monthly update is done by hand when it isn't. --- .agents/skills/docker-and-compose/SKILL.md | 2 +- .agents/skills/packages-and-dependencies/SKILL.md | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/.agents/skills/docker-and-compose/SKILL.md b/.agents/skills/docker-and-compose/SKILL.md index 16854ab..48b87c1 100644 --- a/.agents/skills/docker-and-compose/SKILL.md +++ b/.agents/skills/docker-and-compose/SKILL.md @@ -44,7 +44,7 @@ Every port published on the developer's machine, by the compose file or by `laun 1. Keep restore before `COPY . .` so a code change doesn't redo the restore layer. A new project folder needs nothing extra; the loops pick up every `src/*/*.csproj` and `tests/*/*.csproj`. 2. Anything the app writes goes under `/app/data`, the only folder the app user can write to. -3. Pin every image in compose to a version. Dependabot keeps them current. +3. Pin every image in compose to a version, and bump them with the monthly package update (`packages-and-dependencies`). 4. Change base images through the `ARG`s at the top, not inside a `FROM`. 5. Test locally with `docker compose up -d --build`, then hit `/health/ready` and the API reference. diff --git a/.agents/skills/packages-and-dependencies/SKILL.md b/.agents/skills/packages-and-dependencies/SKILL.md index 4b2c818..820bff7 100644 --- a/.agents/skills/packages-and-dependencies/SKILL.md +++ b/.agents/skills/packages-and-dependencies/SKILL.md @@ -1,6 +1,6 @@ --- name: packages-and-dependencies -description: How NuGet packages are managed with Central Package Management and monthly grouped Dependabot updates, and which packages are not allowed. Use when adding, updating or removing a package. +description: How NuGet packages are managed with Central Package Management and a monthly update, and which packages are not allowed. Use when adding, updating or removing a package. metadata: scope: shared --- @@ -9,7 +9,7 @@ metadata: ## The rule -Versions live in one file, `Directory.Packages.props`, and project files only name the package. Dependabot opens one grouped pull request a month (on the 15th) for NuGet, Docker Compose images and GitHub Actions together. Every package must be free and open source, with no paid or commercial licence tier. +Versions live in one file, `Directory.Packages.props`, and project files only name the package. Packages are updated once a month, all together in one pull request. If the repository has `.github/dependabot.yml`, Dependabot opens that pull request. If it doesn't, update by hand: `dotnet list package --outdated` lists what's behind. Every package must be free and open source, with no paid or commercial licence tier. ## Steps @@ -25,7 +25,7 @@ Versions live in one file, `Directory.Packages.props`, and project files only na - Put `Version=` on a `PackageReference`. - Add MediatR, MassTransit (v9 and later), AutoMapper, FluentAssertions (v8 and later), or any other library that moved to a commercial licence. Use `Mediator`, `Riok.Mapperly` and `Shouldly`. - Add a package to quiet a warning or save a few lines. -- Update one package by hand between Dependabot runs unless it fixes a vulnerability. +- Update one package on its own between the monthly updates unless it fixes a vulnerability. ## Check @@ -33,4 +33,5 @@ Versions live in one file, `Directory.Packages.props`, and project files only na dotnet restore dotnet build dotnet list package --vulnerable +dotnet list package --outdated ```