Skip to content

tools: exclude @node-core/doc-kit from dependabot cooldown#62775

Open
kxxt wants to merge 1 commit intonodejs:mainfrom
kxxt:cooldown-exclude
Open

tools: exclude @node-core/doc-kit from dependabot cooldown#62775
kxxt wants to merge 1 commit intonodejs:mainfrom
kxxt:cooldown-exclude

Conversation

@kxxt
Copy link
Copy Markdown
Member

@kxxt kxxt commented Apr 16, 2026

@node-core/doc-kit is an internal package maintained within the nodejs organization, which is unlikely to be a direct source of supply-chain attack. The cooldown only slow down the propagation of new improvements from doc-kit to Node.js repo and causes surprises.

The cooldown should be configured in the doc-kit repository instead. Currently there is a 3-day cooldown. Maybe we need to increase that to match the 5-day cooldown used in this repository.

This patch excludes @node-core/doc-kit from the cooldown.
Note that @node-core/doc-kit is the only dependency in tools/doc.
But to be future proof, I did't remove the cooldown directly.

CC @nodejs/security-wg @nodejs/web-infra

@nodejs-github-bot nodejs-github-bot added the meta Issues and PRs related to the general management of the project. label Apr 16, 2026
@kxxt kxxt force-pushed the cooldown-exclude branch from 269f140 to 50753ce Compare April 16, 2026 13:54
@ovflowd ovflowd added fast-track PRs that do not need to wait for 72 hours to land. author ready PRs that have at least one approval, no pending requests for changes, and a CI started. dependencies Pull requests that update a dependency file. labels Apr 16, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 16, 2026

Fast-track has been requested by @ovflowd. Please 👍 to approve.

MikeMcC399
MikeMcC399 reviewed Apr 16, 2026
View reviewed changes
Comment thread .github/dependabot.yml Outdated
@kxxt
tools: exclude @node-core/doc-kit from dependabot cooldown
e4b7451 
`@node-core/doc-kit` is an internal package maintained within the nodejs
organization, which is unlikely to be a direct source of supply-chain
attack. The cooldown only slow down the propagation of new improvements
from doc-kit to Node.js repo and causes surprises.

The cooldown should be configured in the `doc-kit` repository instead.
Currently there is a 3-day cooldown. Maybe we need to increase that to
match the 5-day cooldown used in this repository.

This patch excludes `@node-core/doc-kit` from the cooldown.
Note that `@node-core/doc-kit` is the only dependency in `tools/doc`.
But to be future proof, I did't remove the cooldown directly.
@kxxt kxxt force-pushed the cooldown-exclude branch from 50753ce to e4b7451 Compare April 16, 2026 23:42
avivkeller
avivkeller approved these changes Apr 17, 2026
View reviewed changes
Comment thread .github/dependabot.yml
@ovflowd ovflowd added the request-ci Add this label to start a Jenkins CI on a PR. label Apr 17, 2026
@github-actions github-actions bot removed the request-ci Add this label to start a Jenkins CI on a PR. label Apr 17, 2026
@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

nodejs-github-bot commented Apr 17, 2026

CI: https://ci.nodejs.org/job/node-test-pull-request/72732/

@kxxt
Copy link
Copy Markdown
Member Author

kxxt commented Apr 17, 2026

The CI is failing due to flaky tests:

@richardlau
Copy link
Copy Markdown
Member

richardlau commented Apr 17, 2026

The CI is failing due to flaky tests:

This PR didn't need a Jenkins run in the first place, but now that one was started it'll need a clean run to be landable by the commit queue.

@ovflowd
Copy link
Copy Markdown
Member

ovflowd commented Apr 17, 2026

The CI is failing due to flaky tests:

This PR didn't need a Jenkins run in the first place, but now that one was started it'll need a clean run to be landable by the commit queue.

Oh, what conditions determine it requiring a ci run?

@richardlau
Copy link
Copy Markdown
Member

richardlau commented Apr 17, 2026

The CI is failing due to flaky tests:

This PR didn't need a Jenkins run in the first place, but now that one was started it'll need a clean run to be landable by the commit queue.

Oh, what conditions determine it requiring a ci run?

Anything that affects the Node.js binary or tests. Automation should stick a needs-ci label (meaning full Jenkins CI) on the PR.

@nodejs-github-bot
Copy link
Copy Markdown
Collaborator

nodejs-github-bot commented Apr 17, 2026

CI: https://ci.nodejs.org/job/node-test-pull-request/72742/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lpinca lpinca lpinca approved these changes

@cjihrig cjihrig cjihrig approved these changes

@meixg meixg meixg approved these changes

@ovflowd ovflowd ovflowd approved these changes

@avivkeller avivkeller avivkeller approved these changes

+1 more reviewer

@MikeMcC399 MikeMcC399 MikeMcC399 left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

author ready PRs that have at least one approval, no pending requests for changes, and a CI started. dependencies Pull requests that update a dependency file. fast-track PRs that do not need to wait for 72 hours to land. meta Issues and PRs related to the general management of the project.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

9 participants

@kxxt @nodejs-github-bot @richardlau @ovflowd @lpinca @cjihrig @meixg @avivkeller @MikeMcC399