0079 — Dependabot scaled back to security-only, auto-merge disarmed

• Status: Accepted
• Date: 2026-07-06
• Deciders: Fede
• Supersedes: 0077

Context

ADR-0077 (2026-07-03) bet that a comprehensive CI gate could replace human review of dependency PRs: auto-merge everything on green, let breaking majors fail harmlessly, and lean on an agent-smith "janitor" to keep the open-PR list empty. Three days of production experience showed the bet failed on both sides:

1. A dependency upgrade caused a production incident. On 2026-07-04, PR #2975 auto-merged a production-deps group of 41 packages in a single PR with no human review. next build + the test suite pass on plenty of runtime-behavioral regressions in transitive prod dependencies, so "green" was not the safety guarantee the ADR assumed. A 41-package prod batch is maximal blast radius — the opposite of the "homogeneous, independently mergeable" batches the grouping was meant to produce.
2. The noise the ADR promised to eliminate came back. As of 2026-07-06 there were 28 open Dependabot PRs, every one red and blocked — mostly majors the strategy deliberately lets fail (TypeScript 6, ESLint 10, Vitest 4, @types/node 26, Twilio 6, ~10 GitHub Actions majors) plus the Vitest / @vitest/coverage-v8 split that can never npm ci independently. The janitor did not keep the queue empty, so the red wall stood.

The value of routine, proactive version bumps for this repo — at its current stage, with a small team and a live customer — is low and the demonstrated cost (a prod incident + a standing wall of red PRs + reviewer attention) is high. What actually matters is patching known security vulnerabilities promptly; everything else can wait for a deliberate, human-initiated upgrade.

Decision

Scale Dependabot back to security updates only, and take a human out of nothing except the routine noise.

1. Disable all routine version updates. Every lane in .github/dependabot.yml (root npm, agents/clara, testing-harness, mock-pms-service, tools/graphify, tools/agent-smith uv, and GitHub Actions) is set to open-pull-requests-limit: 0. Per GitHub's documented behavior this disables scheduled version updates while leaving security updates unaffected — so Dependabot still opens a PR the moment a dependency has a real vulnerability alert, and opens nothing otherwise. One entry per manifest is retained so security updates stay directory-scoped; graphology stays ignored (it's coupled to a hand-vendored viewer bundle).
2. Remove auto-merge. .github/workflows/dependabot-auto-merge.yml is deleted — the now-rare security PRs are reviewed and merged by a human. Re-arming later means restoring the workflow from git history (the same re-arm path chosen for the routine config above), and if re-armed it should be scoped to single-package security patches on green, never the everything-including-large-prod-batches arm this replaces.
3. Requires two repo settings stay ON. Security-update PRs depend on both Dependabot alerts and Dependabot security updates being enabled for the repo (Settings → Code security). Alerts alone only notify; the security-updates toggle is what actually opens the fix PR. Neither may regress, or security-only silently becomes update-nothing.
4. Majors and routine currency are now a human decision. Framework/tooling upgrades (Next.js, TypeScript, ESLint, Vitest, Twilio, etc.) happen when a person chooses to do one, deliberately, in its own PR with real validation — not as a perpetual auto-opened queue. This is a conscious trade of "always current" for "quiet and safe."

Consequences

• The 28 standing red PRs stop reopening once this lands, but the existing ones must be closed once as a one-time cleanup (they will not auto-close). That bulk-close is a visible action (notifications) and is left for an explicit, separate step.
• Dependency currency will drift. Non-security minor/patch updates no longer land automatically; periodic manual npm outdated / deliberate upgrade PRs are the new path. Acceptable at this stage; revisit if/when the team wants proactive currency back.
• The comprehensive CI gate from ADR-0077 (ci-nested.yml, full-suite-on-Dependabot in ci.yml, the Nested Gate required check) is retained — it still protects the security PRs that do land, and any future re-arming, at zero extra cost.
• The agent-smith janitor track (ADR-0077 §5) is moot for as long as the queue is security-only; it can be repurposed or shelved.

Follow-ups

• One-time: close the 28 currently-open routine Dependabot PRs (needs explicit sign-off — bulk PR closes are visible to the team).
• Confirm the vitest critical Dependabot security alert gets its own security-update PR under the new config (it should, since it's alert-driven, not version-driven) and merge it by hand.