feat(janitor): add EXCLUDE_REPOS to dependabot-janitor.sh - #57
Merged
Conversation
Adds a general-purpose exclusion mechanism so a repo can be held out of the regex-matched scope regardless of matching -mcp$|^mcp|^node- -- not a one-time hack, any repo with an untrustworthy CI signal in the future should go here too. Immediate use: 25 repos are still pinned to the pre-fix mcp-server-release.yml (confirmed live via org code search for the known pre-fix SHA d28a612) -- the same vacuous-CI bug class that got this janitor disabled on 2026-07-21 (task_1786765529531). Only 3 repos have been migrated to the fixed workflow so far (forge, task_1787061665784). Re-enabling the janitor across its full regex-matched scope today would put it back in front of a CI signal that's still fake for those 25 repos -- the same incident shape, not a new one. Tested: shellcheck clean. Ran live in dry-run with EXCLUDE_REPOS set to the 25 confirmed-stale-pin repos -- correctly scanned 80 repos instead of 105, output looked sane (116 would-merge, 20 majors, 9 red, 1 conflict, 0 errors) across a spot-checked sample of routine dependency bumps. 🤖 Generated by murph (WYRE mcp-gateway caretaker agent, also does cortextos dependency/ops hygiene)
asachs01
added a commit
that referenced
this pull request
Aug 21, 2026
Sets EXCLUDE_REPOS (added in #57) to the 25 repos confirmed still on the pre-fix mcp-server-release.yml pin, so re-enabling the janitor doesn't put it back in front of a vacuous-CI signal for them. Pin-migration work tracked separately with forge; remove a repo from this list only after confirming its pin moved AND a real PR showed genuine red/green CI. 🤖 Generated by murph (WYRE mcp-gateway caretaker agent, also does cortextos dependency/ops hygiene)
This was referenced Aug 21, 2026
Merged
chore(ci): bump mcp-server-release/deploy.yml pins to current .github main
WYRE-AI/blackpoint-mcp#62
Merged
asachs01
added a commit
to wyre-technology/axcient-mcp
that referenced
this pull request
Aug 21, 2026
… main (#5) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to wyre-technology/afkbot-mcp
that referenced
this pull request
Aug 21, 2026
… main (#45) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to WYRE-AI/auvik-mcp
that referenced
this pull request
Aug 21, 2026
… main (#52) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to WYRE-AI/avanan-mcp
that referenced
this pull request
Aug 21, 2026
… main (#54) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to WYRE-AI/blackpoint-mcp
that referenced
this pull request
Aug 21, 2026
… main (#62) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
This was referenced Aug 21, 2026
Merged
Merged
Merged
asachs01
added a commit
to WYRE-AI/cipp-mcp
that referenced
this pull request
Aug 21, 2026
… main (#85) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to WYRE-AI/connectwise-cpq-mcp
that referenced
this pull request
Aug 21, 2026
… main (#10) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to WYRE-AI/crewhu-mcp
that referenced
this pull request
Aug 21, 2026
… main (#55) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to WYRE-AI/domotz-mcp
that referenced
this pull request
Aug 21, 2026
… main (#57) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to WYRE-AI/freshdesk-mcp
that referenced
this pull request
Aug 21, 2026
… main (#24) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
This was referenced Aug 21, 2026
Merged
This was referenced Aug 21, 2026
Merged
asachs01
added a commit
to WYRE-AI/hudu-mcp
that referenced
this pull request
Aug 21, 2026
… main (#48) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to WYRE-AI/immybot-mcp
that referenced
this pull request
Aug 21, 2026
… main (#60) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to WYRE-AI/inforcer-mcp
that referenced
this pull request
Aug 21, 2026
… main (#27) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to wyre-technology/ironscales-mcp
that referenced
this pull request
Aug 21, 2026
… main (#47) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to WYRE-AI/itglue-mcp
that referenced
this pull request
Aug 21, 2026
… main (#93) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
This was referenced Aug 21, 2026
Merged
chore(ci): bump mcp-server-release/deploy.yml pins to current .github main
WYRE-AI/proofpoint-mcp#63
Merged
Merged
Merged
asachs01
added a commit
to wyre-technology/mailprotector-mcp
that referenced
this pull request
Aug 21, 2026
… main (#6) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to WYRE-AI/knowbe4-mcp
that referenced
this pull request
Aug 21, 2026
… main (#59) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to wyre-technology/mimecast-mcp
that referenced
this pull request
Aug 21, 2026
… main (#63) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to WYRE-AI/proofpoint-mcp
that referenced
this pull request
Aug 21, 2026
… main (#63) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to WYRE-AI/qbo-mcp
that referenced
this pull request
Aug 21, 2026
… main (#65) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to WYRE-AI/saas-alerts-mcp
that referenced
this pull request
Aug 21, 2026
… main (#17) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to wyre-technology/scalepad-mcp
that referenced
this pull request
Aug 21, 2026
… main (#12) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to WYRE-AI/sherweb-mcp
that referenced
this pull request
Aug 21, 2026
… main (#68) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to wyre-technology/spamtitan-mcp
that referenced
this pull request
Aug 21, 2026
… main (#52) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
asachs01
added a commit
to WYRE-AI/timezest-mcp
that referenced
this pull request
Aug 21, 2026
… main (#60) Was pinned to d28a612a/a61021de (scaffold-era, never updated). Current main has ~30 commits since, including real fixes: mcpb-pack asset upload, add-to-project Dependabot hard-fail fix, digest-verify fixes, an unconditional build/lint/test verify job, and the mcpb-CLI-install fix. This repo was held out of dependabot-janitor's scope (EXCLUDE_REPOS, wyre-technology/.github#57/#58) specifically because its CI was vacuous until this migration -- same bug class that broke 3 repos in July. task_1787320127660
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
EXCLUDE_REPOStodependabot-janitor.sh-- a general-purpose way to hold a repo out of the regex-matched scope regardless of matching-mcp$|^mcp|^node-. Not built for a single one-off case: any future repo found with an untrustworthy CI signal should go on this list too, rather than being silently swept in because it matches the pattern.Why now
Boss relayed Aaron's directive to re-enable
dependabot-janitor(currentlydisabled_manuallysince 2026-07-21, pertask_1786765529531) and clear the 241-PR dependabot backlog. Before flipping it back on, checked whether the sequenced remediation plan that disabled it was actually complete:mcp-server-release.yml's vacuous-CI gap) -- done,.githubfix(ci): add unconditional build/lint/test job to mcp-server-release.yml #47 merged 2026-08-15.d28a612a) found 25 repos still on it. Only 3 have been migrated so far (forge,task_1787061665784) -- and one of those 3 turned out to have a real pre-existing bug the vacuous CI had been hiding, which is exactly the failure shape that got this janitor disabled in the first place.Re-enabling the janitor across its full scope today would put it back in front of a CI signal that's still fake for 25 repos -- reproducing the original incident, not avoiding it. This PR lets it go live for the ~80 repos that are genuinely on real CI now, while holding out the 25 until each is migrated (tracked as ongoing work, dispatched separately).
Test plan
shellcheckcleanDRY_RUN=truewithEXCLUDE_REPOSset to the 25 confirmed-stale-pin repos: correctly scanned 80 repos instead of 105 (the full regex-matched set), output looked sane -- 116 would-merge (routine dependency-group bumps, spot-checked), 20 majors held for human review, 9 red CI, 1 conflict, 0 errors.🤖 Generated by murph (WYRE mcp-gateway caretaker agent, also does cortextos dependency/ops hygiene)
Need help on this PR? Tag
@codesmith-botwith what you need. Autofix is enabled.