eslint-plugin-github-actions-2 1.0.5 → 1.0.6

package/dist/rules/require-dependabot-open-pull-requests-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"require-dependabot-open-pull-requests-limit.d.ts","sourceRoot":"","sources":["../../src/rules/require-dependabot-open-pull-requests-limit.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAYnC,kEAAkE;AAClE,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UA4DhB,CAAC;AAEF,eAAe,IAAI,CAAC"}
+{"version":3,"file":"require-dependabot-open-pull-requests-limit.d.ts","sourceRoot":"","sources":["../../src/rules/require-dependabot-open-pull-requests-limit.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAanC,kEAAkE;AAClE,QAAA,MAAM,IAAI,EAAE,IAAI,CAAC,UA+GhB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/dist/rules/require-dependabot-open-pull-requests-limit.js

@@ -1,8 +1,9 @@
-import { getDependabotRoot, getDependabotUpdateEntries, getDependabotUpdateLabel, } from "../_internal/dependabot-yaml.js";
+import { getDependabotReferencedGroup, getDependabotRoot, getDependabotUpdateEntries, getDependabotUpdateLabel, } from "../_internal/dependabot-yaml.js";
 import { getMappingPair, getScalarNumberValue, } from "../_internal/workflow-yaml.js";
 /** Rule implementation for requiring open-pull-requests-limit. */
 const rule = {
     create(context) {
+        const reportedGroupNames = new Set();
         return {
             Program() {
                 const root = getDependabotRoot(context);
@@ -11,6 +12,33 @@ const rule = {
                 }
                 for (const update of getDependabotUpdateEntries(root)) {
                     const limitPair = getMappingPair(update.mapping, "open-pull-requests-limit");
+                    if (update.multiEcosystemGroup !== null) {
+                        if (limitPair !== null) {
+                            context.report({
+                                data: {
+                                    updateLabel: getDependabotUpdateLabel(update),
+                                },
+                                messageId: "unsupportedOpenPullRequestsLimitOnGroupedUpdate",
+                                node: limitPair.key,
+                            });
+                        }
+                        const groupMapping = getDependabotReferencedGroup(root, update);
+                        const groupLimitPair = groupMapping === null
+                            ? null
+                            : getMappingPair(groupMapping, "open-pull-requests-limit");
+                        if (groupLimitPair !== null &&
+                            !reportedGroupNames.has(update.multiEcosystemGroup)) {
+                            reportedGroupNames.add(update.multiEcosystemGroup);
+                            context.report({
+                                data: {
+                                    groupName: update.multiEcosystemGroup,
+                                },
+                                messageId: "unsupportedOpenPullRequestsLimitOnGroup",
+                                node: groupLimitPair.key,
+                            });
+                        }
+                        continue;
+                    }
                     const limitValue = getScalarNumberValue(limitPair?.value ?? null);
                     if (limitValue !== null) {
                         continue;
@@ -35,7 +63,7 @@ const rule = {
                 "github-actions.configs.all",
                 "github-actions.configs.dependabot",
             ],
-            description: "require Dependabot update entries to define `open-pull-requests-limit`.",
+            description: "require standalone Dependabot update entries to define `open-pull-requests-limit`.",
             dialects: ["Dependabot configuration"],
             frozen: false,
             recommended: true,
@@ -46,6 +74,8 @@ const rule = {
         },
         messages: {
             missingOpenPullRequestsLimit: "{{updateLabel}} should define `open-pull-requests-limit` so Dependabot pull request volume is explicitly controlled.",
+            unsupportedOpenPullRequestsLimitOnGroup: "Multi-ecosystem group '{{groupName}}' should not define `open-pull-requests-limit`. Grouped updates already consolidate into a single Dependabot pull request.",
+            unsupportedOpenPullRequestsLimitOnGroupedUpdate: "{{updateLabel}} uses `multi-ecosystem-group` and should not define `open-pull-requests-limit`. Grouped updates already consolidate into a single Dependabot pull request.",
         },
         schema: [],
         type: "suggestion",

package/dist/rules/require-dependabot-open-pull-requests-limit.js.map

@@ -1 +1 @@
-{"version":3,"file":"require-dependabot-open-pull-requests-limit.js","sourceRoot":"","sources":["../../src/rules/require-dependabot-open-pull-requests-limit.ts"],"names":[],"mappings":"AAMA,OAAO,EACH,iBAAiB,EACjB,0BAA0B,EAC1B,wBAAwB,GAC3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACH,cAAc,EACd,oBAAoB,GACvB,MAAM,+BAA+B,CAAC;AAEvC,kEAAkE;AAClE,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAExC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpD,MAAM,SAAS,GAAG,cAAc,CAC5B,MAAM,CAAC,OAAO,EACd,0BAA0B,CAC7B,CAAC;oBACF,MAAM,UAAU,GAAG,oBAAoB,CACnC,SAAS,EAAE,KAAK,IAAI,IAAI,CAC3B,CAAC;oBAEF,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;wBACtB,SAAS;oBACb,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,IAAI,EAAE;4BACF,WAAW,EAAE,wBAAwB,CAAC,MAAM,CAAC;yBAChD;wBACD,SAAS,EAAE,8BAA8B;wBACzC,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK;4BACnB,SAAS;4BACT,MAAM,CAAC,IAAI,CAAyB;qBAC3C,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,mCAAmC;aACtC;YACD,WAAW,EACP,yEAAyE;YAC7E,QAAQ,EAAE,CAAC,0BAA0B,CAAC;YACtC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,oHAAoH;SAC5H;QACD,QAAQ,EAAE;YACN,4BAA4B,EACxB,sHAAsH;SAC7H;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,YAAY;KACA;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}
+{"version":3,"file":"require-dependabot-open-pull-requests-limit.js","sourceRoot":"","sources":["../../src/rules/require-dependabot-open-pull-requests-limit.ts"],"names":[],"mappings":"AAMA,OAAO,EACH,4BAA4B,EAC5B,iBAAiB,EACjB,0BAA0B,EAC1B,wBAAwB,GAC3B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACH,cAAc,EACd,oBAAoB,GACvB,MAAM,+BAA+B,CAAC;AAEvC,kEAAkE;AAClE,MAAM,IAAI,GAAoB;IAC1B,MAAM,CAAC,OAAO;QACV,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QAE7C,OAAO;YACH,OAAO;gBACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAExC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAChB,OAAO;gBACX,CAAC;gBAED,KAAK,MAAM,MAAM,IAAI,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpD,MAAM,SAAS,GAAG,cAAc,CAC5B,MAAM,CAAC,OAAO,EACd,0BAA0B,CAC7B,CAAC;oBAEF,IAAI,MAAM,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;wBACtC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;4BACrB,OAAO,CAAC,MAAM,CAAC;gCACX,IAAI,EAAE;oCACF,WAAW,EACP,wBAAwB,CAAC,MAAM,CAAC;iCACvC;gCACD,SAAS,EACL,iDAAiD;gCACrD,IAAI,EAAE,SAAS,CAAC,GAA2B;6BAC9C,CAAC,CAAC;wBACP,CAAC;wBAED,MAAM,YAAY,GAAG,4BAA4B,CAC7C,IAAI,EACJ,MAAM,CACT,CAAC;wBACF,MAAM,cAAc,GAChB,YAAY,KAAK,IAAI;4BACjB,CAAC,CAAC,IAAI;4BACN,CAAC,CAAC,cAAc,CACV,YAAY,EACZ,0BAA0B,CAC7B,CAAC;wBAEZ,IACI,cAAc,KAAK,IAAI;4BACvB,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,EACrD,CAAC;4BACC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;4BAEnD,OAAO,CAAC,MAAM,CAAC;gCACX,IAAI,EAAE;oCACF,SAAS,EAAE,MAAM,CAAC,mBAAmB;iCACxC;gCACD,SAAS,EACL,yCAAyC;gCAC7C,IAAI,EAAE,cAAc,CAAC,GAA2B;6BACnD,CAAC,CAAC;wBACP,CAAC;wBAED,SAAS;oBACb,CAAC;oBAED,MAAM,UAAU,GAAG,oBAAoB,CACnC,SAAS,EAAE,KAAK,IAAI,IAAI,CAC3B,CAAC;oBAEF,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;wBACtB,SAAS;oBACb,CAAC;oBAED,OAAO,CAAC,MAAM,CAAC;wBACX,IAAI,EAAE;4BACF,WAAW,EAAE,wBAAwB,CAAC,MAAM,CAAC;yBAChD;wBACD,SAAS,EAAE,8BAA8B;wBACzC,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK;4BACnB,SAAS;4BACT,MAAM,CAAC,IAAI,CAAyB;qBAC3C,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;IACD,IAAI,EAAE;QACF,UAAU,EAAE,KAAK;QACjB,IAAI,EAAE;YACF,OAAO,EAAE;gBACL,4BAA4B;gBAC5B,mCAAmC;aACtC;YACD,WAAW,EACP,oFAAoF;YACxF,QAAQ,EAAE,CAAC,0BAA0B,CAAC;YACtC,MAAM,EAAE,KAAK;YACb,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,KAAK;YAC3B,MAAM,EAAE,MAAM;YACd,UAAU,EAAE,EAAE;YACd,GAAG,EAAE,oHAAoH;SAC5H;QACD,QAAQ,EAAE;YACN,4BAA4B,EACxB,sHAAsH;YAC1H,uCAAuC,EACnC,gKAAgK;YACpK,+CAA+C,EAC3C,2KAA2K;SAClL;QACD,MAAM,EAAE,EAAE;QACV,IAAI,EAAE,YAAY;KACA;CACzB,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/docs/rules/require-dependabot-open-pull-requests-limit.md

@@ -4,16 +4,20 @@
 
 ## Targeted pattern scope
 
-Dependabot update entries in `.github/dependabot.yml`.
+Standalone Dependabot update entries in `.github/dependabot.yml` that do not use `multi-ecosystem-group`.
 
 ## What this rule reports
 
-This rule reports update entries that do not define `open-pull-requests-limit`.
+This rule reports standalone update entries that do not define `open-pull-requests-limit`.
+
+It also reports grouped configurations that set `open-pull-requests-limit` on either the update entry or the referenced multi-ecosystem group.
 
 ## Why this rule exists
 
 Dependabot defaults can be reasonable, but they are still implicit. Requiring an explicit open pull request limit makes update volume a deliberate repository policy.
 
+Updates that use `multi-ecosystem-group` are intentionally excluded. GitHub creates a single pull request per multi-ecosystem group, so `open-pull-requests-limit` does not apply there and should not be set.
+
 ## ❌ Incorrect
 
 ```yaml
@@ -25,6 +29,19 @@ updates:
       interval: "weekly"
 ```
 
+```yaml
+version: 2
+multi-ecosystem-groups:
+  app:
+    open-pull-requests-limit: 5
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    multi-ecosystem-group: "app"
+    schedule:
+      interval: "weekly"
+```
+
 ## ✅ Correct
 
 ```yaml
@@ -39,7 +56,7 @@ updates:
 
 ## Additional examples
 
-This rule works well with grouped updates because the repository can cap Dependabot volume even when multiple manifests are monitored.
+This rule is intentionally limited to standalone update entries. Grouped updates already consolidate into one pull request per multi-ecosystem group.
 
 ## ESLint flat config example
 
@@ -51,7 +68,7 @@ export default [githubActions.configs.dependabot];
 
 ## When not to use it
 
-Disable this rule if the repository intentionally relies on Dependabot's built-in default PR limit.
+Disable this rule if the repository intentionally relies on Dependabot's built-in default PR limit for standalone updates.
 
 ## Further reading
 

package/package.json

@@ -1,7 +1,7 @@
 {
     "$schema": "https://www.schemastore.org/package.json",
     "name": "eslint-plugin-github-actions-2",
-    "version": "1.0.5",
+    "version": "1.0.6",
     "private": false,
     "description": "ESLint plugin for GitHub Actions workflow quality, reliability, and security rules.",
     "keywords": [