Skip to content

[Copilot Dreams] Avoid misleading and duplicated dependency-update guidance - #181

Open
Copilot wants to merge 6 commits into
mainfrom
copilot/dream-curate-memories-20261111025226
Open

Copilot wants to merge 6 commits into
mainfrom
copilot/dream-curate-memories-20261111025226

Conversation

@Copilot

Copilot AI commented Nov 11, 2026

Copy link
Copy Markdown

🧠 How this helps Copilot

Finding dependency files does not establish that updates are available. Removing that implication keeps ecosystem discovery separate from the later update checks.

Keeping branch selection, Cargo working-directory requirements, and no-update handling with their existing instructions avoids maintaining repeated rules. The dependency-update overview and numbered workflow still cover the full lifecycle.

Automated details

Source: curate-memories Dream, analyzing main at 598b4a1.

Discarded guidance: Workflow-file detection stays unchanged: both filename extensions are present in the analyzed checkout, so its current command was not shown to fail.

⚠️ Validation not completed

make test could not complete: benchmark equivalence tests require tokenizer files from huggingface.co, whose hostname could not be resolved. make lint passed.

Copilot AI added 6 commits November 11, 2026 02:52
Repeating the dependency PR target in introductory context creates another
copy to maintain without changing the updater's action. The creation step
already requires main and supplies --base main; branch setup remains intact.

Evidence: https://github.com/github/rust-gems/blob/598b4a16e2eaeff088a7841eaf1d921e25f3ce0c/.github/skills/update-deps/SKILL.md#L211-L216

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
A second lifecycle description adds upkeep without a distinct reader action.
The imperative overview already names discovery, grouped updates, breakage
repair, green CI, and review handoff, and the numbered workflow retains each
stage. The separate Dependabot schedule and target statement is unchanged.

Evidence: https://github.com/github/rust-gems/blob/598b4a16e2eaeff088a7841eaf1d921e25f3ce0c/.github/skills/update-deps/SKILL.md#L9
Evidence: https://github.com/github/rust-gems/blob/598b4a16e2eaeff088a7841eaf1d921e25f3ce0c/.github/skills/update-deps/SKILL.md#L69-L267

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Finding dependency files could be mistaken for proving updates are pending.
The presence checks establish only which ecosystems exist; the later
dependency-intelligence step still finds actual updates. Removing that
misleading lead-in leaves both stages and their commands unchanged.

Evidence: https://github.com/github/rust-gems/blob/598b4a16e2eaeff088a7841eaf1d921e25f3ce0c/.github/skills/update-deps/SKILL.md#L61-L65
Evidence: https://github.com/github/rust-gems/blob/598b4a16e2eaeff088a7841eaf1d921e25f3ce0c/.github/skills/update-deps/SKILL.md#L69-L100

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Another target-branch rule duplicates the complete PR-creation instruction.
The main target survives in step 6 and its command; the removed dev-branch
explanation supplies no additional action beyond that target. The separate
feature-branch requirement and prohibition on pushing main remain unchanged.

Evidence: https://github.com/github/rust-gems/blob/598b4a16e2eaeff088a7841eaf1d921e25f3ce0c/.github/skills/update-deps/SKILL.md#L211-L216
Evidence: https://github.com/github/rust-gems/blob/598b4a16e2eaeff088a7841eaf1d921e25f3ce0c/.github/skills/update-deps/SKILL.md#L272

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Repeating the workspace recipe in edge cases creates a second maintenance
point without a distinct trigger or action. The earlier cargo update/check
recipe already requires the repository root and explains per-crate manifests
and the single root lockfile. Those requirements remain unchanged.

Evidence: https://github.com/github/rust-gems/blob/598b4a16e2eaeff088a7841eaf1d921e25f3ce0c/.github/skills/update-deps/SKILL.md#L122-L130
Evidence: https://github.com/github/rust-gems/blob/598b4a16e2eaeff088a7841eaf1d921e25f3ce0c/Cargo.toml#L1-L11

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Repeating what to do for an unchanged ecosystem adds upkeep without a
different reader action. The guideline already requires skipping it and
telling the user, and the neighboring rule retains serial ecosystem work.
The removed optional exit introduces no extra duty when the work is finished.

Evidence: https://github.com/github/rust-gems/blob/598b4a16e2eaeff088a7841eaf1d921e25f3ce0c/.github/skills/update-deps/SKILL.md#L276-L277

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@Copilot
Copilot AI requested a review from a team as a code owner November 11, 2026 02:52
Copilot AI auto review requested due to automatic review settings November 11, 2026 02:52
## Repository context

This is a Rust workspace containing utility crates published to crates.io. All dependency update PRs target the **`main`** branch.
This is a Rust workspace containing utility crates published to crates.io.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Keep the target beside creation: Repeating the target in introductory context creates another rule to maintain without changing the updater's action. The PR-creation instruction and command already require main, and branch setup remains unchanged. Commit

This is a Rust workspace containing utility crates published to crates.io.

Dependabot is configured (`.github/dependabot.yaml`) to open PRs against `main` on the 2nd of each month. This skill gathers individual dependabot PRs, combines updates by ecosystem, fixes any breakage, gets CI green, and creates consolidated PRs for human review.
Dependabot is configured (`.github/dependabot.yaml`) to open PRs against `main` on the 2nd of each month.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Keep one lifecycle overview: A second lifecycle description adds upkeep without a distinct duty: the imperative overview already covers discovery, grouped updates, repairs, green CI, and review handoff, and the numbered workflow retains those stages. The separate Dependabot schedule and target statement stays unchanged. Commit

git rev-parse --verify origin/main
```

Detect which ecosystems have pending updates:

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Separate discovery from update checks: Finding dependency files could be mistaken for proving updates are pending. The presence checks establish only ecosystem availability; the later intelligence step still finds updates. Both sets of commands remain unchanged. Commit


## Guidelines

- **All PRs target `main`.** There is no separate dev branch.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Keep one PR-target mandate: Another target rule adds maintenance without an independent action. The creation step still requires every dependency PR to target main; the removed dev-branch explanation adds no action beyond that target. The separate feature-branch and no-direct-push requirements remain. Commit


## Edge cases

- **Cargo workspace:** Dependencies are declared per-crate but share a single `Cargo.lock` at the workspace root. Always run `cargo update` and `cargo check` from the repo root.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Keep Cargo guidance with its commands: A repeated workspace item creates another maintenance point without a distinct trigger or action. The earlier Cargo recipe already requires root execution and explains per-crate manifests and the root lockfile; those requirements remain intact. Commit

- **npm:** Look for `package.json` files to discover npm packages rather than hardcoding paths — the repo layout may change.
- **WASM builds:** After updating `wasm-bindgen` or related deps, verify `make build-js` still works — WASM toolchain version mismatches are common.
- **Rate limits:** If `gh api` hits rate limits, wait and retry. Report to user if persistent.
- **Nothing to update:** Report cleanly and move to the next ecosystem (or exit).

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Keep one no-updates branch: Repeating the empty-update disposition adds upkeep without a different reader action. The existing rules already require skipping unchanged ecosystems, telling the user, and working through ecosystems serially. Optional exit when finished adds no further duty. Commit

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The update-deps skill removes misleading and duplicated guidance while retaining the authoritative workflow and operational instructions, with no active review issues identified.

No open issues 🎉

What changed in this PR

This PR streamlines the update-deps skill by removing misleading ecosystem-update wording and duplicated instructions while preserving the authoritative workflow and guidelines.

Changes:

  • Removes the implication that ecosystem discovery confirms pending updates.
  • Removes duplicated guidance about targeting main, Cargo workspace execution, and no-update handling.
  • Preserves the corresponding operational instructions in the workflow and guidelines sections.
File Description
.github/​skills/​update-deps/​SKILL.md Consolidates dependency-update guidance by removing misleading and redundant instructions while preserving the complete workflow.

Review effort: Lite (auto)

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants