chore: suppress Dependabot minor/patch version bump PRs for Cargo deps

[sandersaares]

Problem

Dependabot creates noisy PRs for non-major version bumps of Cargo dependencies. For example, PR #347 bumped uuid from 1.22.0 to 1.23.0 — a minor version bump where the existing caret range "1.21" (meaning >=1.21.0, <2.0.0) already covers 1.23.0. There is no reason for Dependabot to modify Cargo.toml in this case.

Solution

Ignore all semver-minor and semver-patch Cargo dependency updates. Only major version bumps and security vulnerability fixes will create PRs.

What still creates PRs

• Major version bumps (e.g., 1.x → 2.0, 0.x → 1.0)
• Security vulnerability fixes — Dependabot security updates are a separate system driven by GitHub Security Advisories. They are not affected by ignore rules and will continue to create PRs for any dependency with a known vulnerability.

Known limitation: 0.x breaking changes are also suppressed

In Rust, 0.1.x → 0.2.x is a breaking change, but Dependabot classifies it as semver-minor. There is no way to configure Dependabot to understand Rust's 0.x convention.

This is a real tradeoff — 39 of 70 external dependencies (56%) are at 0.x versions. The ideal solution would be versioning-strategy: increase-if-necessary, which would only modify Cargo.toml when the current caret range doesn't cover the new version (naturally respecting Cargo's 0.x semantics). However, Cargo only supports auto and lockfile-only for versioning-strategy — see dependabot-core#4009.

A comment is left in dependabot.yml linking to that issue so a future maintainer can switch to increase-if-necessary if/when it becomes available.

Why we accept this tradeoff

1. Security is still covered. Dependabot security updates bypass ignore rules entirely.
2. The alternative is worse. Allowing semver-minor through means every minor bump for all 70 deps creates a PR — the exact problem we're solving.
3. Major 0.x transitions still arrive. A 0.x → 1.0 bump is semver-major and still creates a PR.
4. Awareness through other channels. Breaking changes in actively-used 0.x crates are typically discovered through release announcements and CI breakage during routine development.

Other changes

• Removed the tokio-specific ignore rule — now covered by the wildcard.
• Added a branching convention note to AGENTS.md: never commit directly to main.

Testing

Configuration-only change. No code or tests affected.

[Copilot]

Pull request overview

This PR reduces Dependabot noise for Rust (Cargo) dependencies by ignoring semver-compatible (minor and patch) version bump PRs while still allowing major updates and security update PRs.

Changes:

• Updated Cargo Dependabot ignore rules to suppress both semver-minor and semver-patch updates via a wildcard rule.
• Removed the now-redundant tokio-specific ignore rule.
• Documented a branching convention in AGENTS.md (don’t commit directly to main).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
AGENTS.md	Adds a “Branching” section documenting the repository workflow expectation.
.github/dependabot.yml	Expands Cargo ignore rules to suppress minor+patch PRs (while keeping majors/security unaffected).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Vaiz]

how does it work with 0.x.y versions? that's probably 90% of our deps

[sandersaares]

It will not bump 0.x versions. Ideally dependabot would be Cargo-smart about it but it seems not to be. But noisy systems that spam us will quickly be ignored so we cannot tolerate it - better to miss upgrade PRs than to have pointless ones generated.

[Vaiz]

can you estimate how much noise it actually creates?

[sandersaares]

44% of our dependencies are within the "would cause bad PRs" bucket. It is not only the noise but also the fact that engineers have to know that these are bad PRs. Terrible developer experience and bound to cause misfires.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.0%. Comparing base (9dd7b27) to head (ce97976).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #349   +/-   ##
=======================================
  Coverage   100.0%   100.0%           
=======================================
  Files         212      212           
  Lines       15551    15551           
=======================================
  Hits        15551    15551           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Vaiz]

personally, I don't see a problem in closing PRs with @dependabot ignore this major version couple times a month. It's still better than missing breaking changes in 0.x releases

[sandersaares]

Hmmm there is actually versioning-strategy: increase-if-necessary which would only update the lockfile for minor versions (if I understand it right). That might actually be more useful. Will investigate deeper - marking back as draft for now.

[sandersaares]

versioning-strategy: increase-if-necessary does not yet work with Cargo (PR description updated with details). Once it becomes available, it would solve the problem by making app Dependabot PRs good and desirable. Until then, this seems to be the best achievable.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The comment mentions "Dependabot security alerts" being unaffected by ignore rules; alerts and security update PRs are different features. Consider rewording to "Dependabot security updates (if enabled)" to avoid implying that alerts alone will produce PRs.

Suggested change

	# by Dependabot security alerts and are not affected by these ignore rules.
	# by Dependabot security updates (if enabled) and are not affected by these ignore rules.