From 1ed44d86fb2dec61df962a90303d7ab3732490d9 Mon Sep 17 00:00:00 2001 From: Anton Volkov Date: Sat, 7 Nov 2026 15:19:06 +0100 Subject: [PATCH 1/3] Stop Dependabot from bumping the dpctl floor --- .github/AGENTS.md | 2 +- .github/dependabot.yml | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/AGENTS.md b/.github/AGENTS.md index 6b807a17df70..2c50f6521db9 100644 --- a/.github/AGENTS.md +++ b/.github/AGENTS.md @@ -10,4 +10,4 @@ These keep zizmor (`zizmor.yml`, fails on medium or higher findings) and the Ope - `actionlint` runs in pre-commit. - `workflows/array-api-skips.txt` lists array-api-tests node IDs skipped by the conformance job; precede each with a comment naming the upstream issue. - `bump-sycl-deps.yml` rewrites the `DRIVER_PATH`, `OCLCPUEXP_FN`, `TBB_URL`, `TBB_INSTALL_DIR` and `TBB_FN` pins in `.github/sycl-build-deps.env` with `sed`, and `os-llvm-sycl-build.yml` reads exactly those five; keep one unquoted `KEY=VALUE` per line, starting at column 0. -- Dependabot (`dependabot.yml`) bumps actions, `environments/` pins and pre-commit hooks weekly with a 7-day cooldown. +- Dependabot (`dependabot.yml`) bumps actions, `environments/` pins and pre-commit hooks weekly with a 7-day cooldown. It ignores `dpctl`, whose floor tracks the dpctl dev series and is bumped by hand. diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 7af8cbab0077..1d41bd56b71a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -13,7 +13,6 @@ updates: github-actions: patterns: ["*"] - # Note: only "==" pins are bumped; ">=" floors and dev pre-releases are not - package-ecosystem: "pip" directory: "/environments" schedule: @@ -26,6 +25,9 @@ updates: groups: pip: patterns: ["*"] + ignore: + # Bumped by hand: the floor tracks the dpctl dev series (X.Y.0dev0) + - dependency-name: "dpctl" # Handles plain conda-forge "pkg=X.Y.Z" pins and pip: sections - package-ecosystem: "conda" From f91981a055cbcf9fd106b4b62d27b3aa2297d79e Mon Sep 17 00:00:00 2001 From: Anton Volkov Date: Sat, 7 Nov 2026 15:29:06 +0100 Subject: [PATCH 2/3] Replace the dpctl ignore rule with a note on the Dependabot dpctl PR --- .github/AGENTS.md | 2 +- .github/dependabot.yml | 5 ++--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/AGENTS.md b/.github/AGENTS.md index 2c50f6521db9..d1e1b5e7543f 100644 --- a/.github/AGENTS.md +++ b/.github/AGENTS.md @@ -10,4 +10,4 @@ These keep zizmor (`zizmor.yml`, fails on medium or higher findings) and the Ope - `actionlint` runs in pre-commit. - `workflows/array-api-skips.txt` lists array-api-tests node IDs skipped by the conformance job; precede each with a comment naming the upstream issue. - `bump-sycl-deps.yml` rewrites the `DRIVER_PATH`, `OCLCPUEXP_FN`, `TBB_URL`, `TBB_INSTALL_DIR` and `TBB_FN` pins in `.github/sycl-build-deps.env` with `sed`, and `os-llvm-sycl-build.yml` reads exactly those five; keep one unquoted `KEY=VALUE` per line, starting at column 0. -- Dependabot (`dependabot.yml`) bumps actions, `environments/` pins and pre-commit hooks weekly with a 7-day cooldown. It ignores `dpctl`, whose floor tracks the dpctl dev series and is bumped by hand. +- Dependabot (`dependabot.yml`) bumps actions, `environments/` pins and pre-commit hooks weekly with a 7-day cooldown. After a `dpctl` release it opens a PR that raises the `dpctl` floor in `environments/dpctl_pkg.txt` only; don't merge it, but bump `dpctl` to the next dev series by hand in every place that pins it. diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1d41bd56b71a..f45bbe7f33d5 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -13,6 +13,8 @@ updates: github-actions: patterns: ["*"] + # A dpctl release makes this raise the dpctl floor in dpctl_pkg.txt only: don't + # merge that PR, bump dpctl to the next dev series in all places by hand instead - package-ecosystem: "pip" directory: "/environments" schedule: @@ -25,9 +27,6 @@ updates: groups: pip: patterns: ["*"] - ignore: - # Bumped by hand: the floor tracks the dpctl dev series (X.Y.0dev0) - - dependency-name: "dpctl" # Handles plain conda-forge "pkg=X.Y.Z" pins and pip: sections - package-ecosystem: "conda" From 01f031bc8bfc1812d90fad2c8f0b99e4031d06bd Mon Sep 17 00:00:00 2001 From: Anton Volkov Date: Sun, 8 Nov 2026 13:35:51 +0100 Subject: [PATCH 3/3] Separate dev-series and release-only dpctl pins in the Dependabot note --- .github/AGENTS.md | 2 +- .github/dependabot.yml | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/AGENTS.md b/.github/AGENTS.md index d1e1b5e7543f..541952ac97fc 100644 --- a/.github/AGENTS.md +++ b/.github/AGENTS.md @@ -10,4 +10,4 @@ These keep zizmor (`zizmor.yml`, fails on medium or higher findings) and the Ope - `actionlint` runs in pre-commit. - `workflows/array-api-skips.txt` lists array-api-tests node IDs skipped by the conformance job; precede each with a comment naming the upstream issue. - `bump-sycl-deps.yml` rewrites the `DRIVER_PATH`, `OCLCPUEXP_FN`, `TBB_URL`, `TBB_INSTALL_DIR` and `TBB_FN` pins in `.github/sycl-build-deps.env` with `sed`, and `os-llvm-sycl-build.yml` reads exactly those five; keep one unquoted `KEY=VALUE` per line, starting at column 0. -- Dependabot (`dependabot.yml`) bumps actions, `environments/` pins and pre-commit hooks weekly with a 7-day cooldown. After a `dpctl` release it opens a PR that raises the `dpctl` floor in `environments/dpctl_pkg.txt` only; don't merge it, but bump `dpctl` to the next dev series by hand in every place that pins it. +- Dependabot (`dependabot.yml`) bumps actions, `environments/` pins and pre-commit hooks weekly with a 7-day cooldown. After a `dpctl` release it opens a PR that raises the `dpctl` floor in `environments/dpctl_pkg.txt` only; don't merge it. Instead, by hand, move the dev-series pins (`[project].dependencies` in `pyproject.toml`, `environments/dpctl_pkg.{txt,yml}`, `conda-recipe/meta.yaml`, `conda-recipe/rattler_recipe.yaml`) to the next `X.Y.0dev0`, and the release-only pins (`[build-system].requires` in `pyproject.toml`, `conda-recipe-cf/meta.yaml`) to the new release. diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f45bbe7f33d5..4bf5234ec7af 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -14,7 +14,8 @@ updates: patterns: ["*"] # A dpctl release makes this raise the dpctl floor in dpctl_pkg.txt only: don't - # merge that PR, bump dpctl to the next dev series in all places by hand instead + # merge that PR; bump the dev pins to the next dev series and the release-only + # pins (build-system, conda-recipe-cf) to the new release by hand (see .github/AGENTS.md) - package-ecosystem: "pip" directory: "/environments" schedule: