Combine Dependabot Prs

Combine Dependabot PRs

Combines all open dependabot PRs on algorand/go-algorand into one branch and PR, using go get + go mod tidy rather than cherry-picking.

Arguments

Optional date suffix for the branch name (e.g. 4-13-26). If omitted, derive one from today's date.

Branch name format: dependabot-<date-suffix> (e.g. dependabot-4-13-26).

Instructions

1. Create the branch

git fetch upstream
git checkout -b dependabot-<DATE> upstream/master

2. List open dependabot PRs

gh pr list --repo algorand/go-algorand --author "app/dependabot" --state open --limit 50 --json number,headRefName,title

3. Check current dependency versions

Before applying any PR, read the current versions from the affected go.mod files:

• go.mod (main module)
• tools/block-generator/go.mod
• tools/debug/algodump/go.mod

Compare against what each dependabot PR wants to change. Skip any PR whose target version is already behind the version currently in the file — this happens when a later dependabot PR supersedes an earlier one (e.g. quic-go already at v0.59.0 when a PR targets v0.57.0).

To read a PR's diff:

gh pr diff <NUMBER> --repo algorand/go-algorand

4. Apply upgrades with go get

For each module that needs changes, run go get with all target packages at their new versions in one command, then tidy:

Main module:

go get <pkg1>@<ver1> <pkg2>@<ver2> ...
go mod tidy

Sub-modules (must use absolute path since the shell may be in a different directory):

cd /path/to/repo/tools/block-generator && go get ... && go mod tidy && cd -
cd /path/to/repo/tools/debug/algodump  && go get ... && go mod tidy && cd -

For otel upgrades, include all related packages together since they version in lockstep:

go.opentelemetry.io/otel
go.opentelemetry.io/otel/metric
go.opentelemetry.io/otel/sdk
go.opentelemetry.io/otel/sdk/metric
go.opentelemetry.io/otel/trace

5. Commit

Stage only the go.mod and go.sum files:

git add go.mod go.sum \
        tools/block-generator/go.mod tools/block-generator/go.sum \
        tools/debug/algodump/go.mod  tools/debug/algodump/go.sum
git commit -m "build: combine dependabot dependency upgrades (<month> <year>)

Combines open dependabot PRs #XXXX, ... into a single commit.
<Skips #XXXX (pkg) since the codebase already has vX.Y.Z.>

Upgrades across main module, tools/block-generator, and
tools/debug/algodump:
- pkg vOLD -> vNEW"

6. Push the branch

Push explicitly to a named remote branch (not the default):

git push origin HEAD:refs/heads/dependabot-<DATE>

Gotcha: git push -u origin <branchname> may push to origin/master instead of creating a new remote branch if the local branch tracks upstream/master. Always use HEAD:refs/heads/<branchname> to be safe.

7. Pick three random reviewers

Choose three reviewers at random from the fixed pool nullun cce algorandskiy cusma giuliop:

ME=$(gh api user -q .login)
REVIEWERS=$(printf '%s\n' jannotti nullun cce algorandskiy cusma giuliop | grep -ivFx "$ME" | sort -R | head -3 | paste -sd, -)
echo "Requesting review from: $REVIEWERS"

8. Create the PR

The PR title is build: dependabot-<DATE> (same date suffix as the branch), tagged enhancement, with the three random reviewers:

gh pr create \
  --repo algorand/go-algorand \
  --head "$ME:dependabot-<DATE>" \
  --base master \
  --title "build: dependabot-<DATE>" \
  --body "..." \
  --label enhancement \
  --reviewer "$REVIEWERS"

PR body should list: which PRs are combined (with closes #XXXX), which are skipped and why, and a test plan.

Notes

• The three Go modules (/, tools/block-generator, tools/debug/algodump) are independent; each needs its own go get + go mod tidy.
• go mod tidy may pull in additional transitive-dependency version bumps beyond what the dependabot PR listed; that is expected and fine.
• Do not include unrelated untracked files (e.g. work-in-progress source files) in the commit.