Configurable changesets for dev dependencies

[mckelveygreg]

Hey! Thanks for the nifty lib!

We just started using this, and combined with dependabots new group parameters, we are well on our way to getting things pretty automated.

However, I just ran into a situation where a dev merged a dependabot pr that had all the checks passing, but borked the build... The pr only had dev deps, but there were some major updates. Also, we only build projects in our monorepo if there is a relevant changeset. Since it wasn't a prod dep, an empty changeset was created. And with an empty changeset, our ci checks were skipped.

Would it be possible to make the hasDirectProdDeps bool configurable? An option to make changesets not matter what?

[feelepxyz]

@mckelveygreg 👋 glad it's of use!

empty changeset was created. And with an empty changeset, our ci checks were skipped.
Would it be possible to make the hasDirectProdDeps bool configurable? An option to make changesets not matter what?

Yes this seems useful!

Just to get some context, are you building more of an app, so not something that's published as a package to a registry? Or do you have a separate publish workflow and hang builds off changesets?

We've mainly used it on https://github.com/sigstore/sigstore-js where we don't care about publishing a new version of the library when dev-deps are updated.

[mckelveygreg]

Yeah, this would be more app focused. Our CI only runs for scopes that have a changeset since main.
For example, the dependabot prs that update a linting dev dep that will break the build, but our CI doesn't run because there would be not changeset for that scope. So in this case, it would be nice to always have a changeset, so that the correct packages are sent through CI