From 159bad362c6461af89e5934c7861f75b619992ae Mon Sep 17 00:00:00 2001
From: Charlie Le <charlie_le@apple.com>
Date: Wed, 19 Aug 2026 13:50:02 -0700
Subject: [PATCH] Track Prometheus and Thanos dependency ignores in
 dependabot.yml

The Prometheus and Thanos module families must move in lockstep with the
pinned github.com/prometheus/prometheus and github.com/thanos-io/thanos,
which we bump manually and jointly. Dependabot's grouped go-dependencies
PRs keep bumping one of them alone, which breaks the build and forces a
manual '@dependabot ignore ...' comment on each PR (e.g. #7781, where
client_golang v1.24 changed api/prometheus/v1.LabelNames to return
model.LabelNames and failed lint, test, and build-integration-tests).

Move that policy into the repo: ignore the whole github.com/prometheus/*
family for major/minor bumps (patches still land automatically for
security fixes), keep prometheus/prometheus itself fully ignored, and
ignore github.com/thanos-io/* outright since those modules are on
pseudo-versions that no update-types filter would match.

Signed-off-by: Charlie Le <charlie_le@apple.com>
---
 .github/dependabot.yml | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a4c57fe9cf7..cb5b92163a6 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -23,8 +23,23 @@ updates:
         exclude-patterns:
           - "github.com/thanos-io/thanos"
     ignore:
+      # The Prometheus and Thanos module families must be upgraded in lockstep with
+      # github.com/prometheus/prometheus and github.com/thanos-io/thanos, which we do
+      # manually — Dependabot bumping one of them alone breaks the build. See
+      # https://github.com/cortexproject/cortex/pull/7781, where client_golang v1.24
+      # changed api/prometheus/v1.LabelNames to return model.LabelNames.
+      #
+      # prometheus/prometheus itself is never auto-bumped. Note it maps Prometheus
+      # 3.x.y to tags v0.30x.y, so its "minor" bumps are real releases.
       - dependency-name: "github.com/prometheus/prometheus"
-        versions:
-          - ">=0.300.0-beta.0"
+      # For the rest of the Prometheus family, block major/minor (where the breaking
+      # changes land) but still allow patches, so security fixes land automatically.
+      - dependency-name: "github.com/prometheus/*"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+      # All thanos-io modules are on pseudo-versions, which don't classify as
+      # major/minor/patch, so update-types wouldn't filter them — ignore outright.
+      - dependency-name: "github.com/thanos-io/*"
     schedule:
       interval: "daily"