Leave basecamp-sdk bumps to coworker's sdk-bump
What
Dependabot stops opening version updates for github.com/basecamp/basecamp-sdk/go. SDK bumps will come from coworker's sdk-bump (basecamp/coworker#281). On the day a release is published it opens one PR here that bumps the module, refreshes the Nix vendorHash and sdk-provenance.json, and runs go build and go vet. It opens even when the bump doesn't compile, with the errors in the body. It closes Dependabot's older SDK bumps in favour of its own.
Why
Dependabot's grouped Go bump has carried the SDK until now. Every 0.x minor breaks the API, so that bump came days late and failed to compile: #911 opened four days after v0.25.0 and is still open.
Security updates for the SDK keep coming. An ignore with no versions blocks version updates only: for security updates Dependabot applies just the explicit versions (dependabot-core: return versions if security_updates_only).
Merge order: sdk-bump's schedule entry is still disabled. Merge this when it gets turned on. Merged before then, nothing bumps the SDK here except a person.
Testing
- The YAML parses, and the gomod entry carries the one ignore.
- Only
.github/dependabot.ymlchanges.
Summary by cubic
Adds a Dependabot ignore for github.com/basecamp/basecamp-sdk/go so SDK version bumps come from coworker's sdk-bump instead of Dependabot's grouped bump, which arrived days late and didn't compile since each 0.x minor breaks the API. Security updates still arrive: Dependabot applies only an ignore's explicit versions to those.
Merge this only after sdk-bump's schedule entry is enabled, otherwise nobody bumps the SDK here except a person.