Skip to content

Commit c1d2316

Browse files
committed
docs(actions): drop the dependabot ignore advice for the v0 action tag
The note said dependabot reads `@v0` as the version `0` rather than as a major-version pin, and told users to ignore `rvben/rumdl` in `.github/dependabot.yml`. Both halves are wrong. The downgrade PRs came from the default 3-day package cooldown GitHub enabled for every ecosystem on 2026-07-14: dependabot works out that a moving major tag is already current, then the cooldown filter discards that answer and re-picks the newest tag older than the window. That is why the proposed version always lagged the tag by a release or two, why it hit `v1`-style tags on other actions too, and why it started on a date rather than always having been the case. Fixed upstream on 2026-08-04 (dependabot/dependabot-core#15738). The remedy was worse than the diagnosis: `ignore` by dependency-name is total, so it also suppresses the eventual `v0` to `v1` migration, permanently, to work around a bug that no longer exists.
1 parent 47f8a50 commit c1d2316

2 files changed

Lines changed: 0 additions & 26 deletions

File tree

README.md

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -492,19 +492,6 @@ jobs:
492492

493493
The `v0` tag always points to the latest stable release, following GitHub Actions conventions.
494494

495-
Dependabot reads `@v0` as the version `0` rather than as a major-version pin, so it opens PRs titled
496-
`bump rvben/rumdl from 0 to 0.2.x`. Merging one replaces the moving tag with a fixed version, which is
497-
the opposite of what `@v0` is for. To keep tracking the tag, ignore the action in
498-
`.github/dependabot.yml`:
499-
500-
```yaml
501-
updates:
502-
- package-ecosystem: github-actions
503-
directory: /
504-
ignore:
505-
- dependency-name: rvben/rumdl
506-
```
507-
508495
#### Inputs
509496

510497
| Input | Description | Default |

docs/usage/ci-cd.md

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -24,19 +24,6 @@ jobs:
2424
2525
The `v0` tag always points to the latest stable release.
2626

27-
Dependabot reads `@v0` as the version `0` rather than as a major-version pin, so it opens PRs titled
28-
`bump rvben/rumdl from 0 to 0.2.x`. Merging one replaces the moving tag with a fixed version, which is
29-
the opposite of what `@v0` is for. To keep tracking the tag, ignore the action in
30-
`.github/dependabot.yml`:
31-
32-
```yaml
33-
updates:
34-
- package-ecosystem: github-actions
35-
directory: /
36-
ignore:
37-
- dependency-name: rvben/rumdl
38-
```
39-
4027
### Action Inputs
4128

4229
| Input | Description | Default |

0 commit comments

Comments
 (0)