Scope Dependabot to our beyond-template packages

.eslintignore

@@ -41,3 +41,7 @@ package-lock.json
 # Playwright test output
 e2e-tests/playwright-report
 e2e-tests/test-results
+
+# A verbatim copy of the template's manifest, kept byte-for-byte so `npm run template:baseline` can
+# write it straight from `git show` rather than a copy plus whatever our tooling would impose on it
+scripts/merged-template-package.json

.github/dependabot.yml

@@ -0,0 +1,80 @@
+# Dependabot is scoped to the packages this extension adds on top of
+# paranext-extension-template. Everything else in package.json comes from the
+# template and is updated only when we merge template changes, so letting
+# Dependabot raise PRs for those would put our lockfile ahead of the template's
+# and create conflicts at the next merge. An allow list filters security updates
+# as well as version updates, so nothing template-owned is touched either way.
+#
+# Keep the allow list in sync with package.json: an entry belongs here if, and
+# only if, it is absent from the template's package.json. The `file:`
+# dependencies are the exception: the ignore list below skips them instead, for
+# the reason recorded beside it. `npm run lint:dependencies` checks that.
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: monthly
+    # The `file:` dependencies resolve against a sibling paranext-core
+    # checkout, which exists on developer machines and in CI but not inside
+    # Dependabot's container. npm's file fetcher resolves path dependencies
+    # before any update is considered, and it consults `ignore` — never `allow` —
+    # when deciding to skip one. Omitting them from the allow list below is
+    # therefore not enough on its own: without these entries they become
+    # unfetchable and the job aborts during file fetching.
+    ignore:
+      - dependency-name: platform-bible-utils
+      - dependency-name: papi-dts
+      - dependency-name: platform-bible-react
+    allow:
+      # dependencies
+      - dependency-name: '@reduxjs/toolkit'
+      - dependency-name: fast-xml-parser
+      - dependency-name: react-redux
+      # devDependencies
+      - dependency-name: '@playwright/test'
+      - dependency-name: '@testing-library/jest-dom'
+      - dependency-name: '@testing-library/react'
+      - dependency-name: '@testing-library/user-event'
+      - dependency-name: '@types/jest'
+      - dependency-name: '@types/ws'
+      - dependency-name: eslint-plugin-jest
+      - dependency-name: jest
+      - dependency-name: jest-environment-jsdom
+      - dependency-name: js-yaml
+      - dependency-name: ts-jest
+      - dependency-name: ws
+    groups:
+      # The tooling we add on top of the template moves together, so one PR per
+      # cycle rather than one per package. Runtime dependencies stay out: those
+      # ship to users. Major bumps stay ungrouped too, being worth reading on
+      # their own.
+      dev-tooling:
+        applies-to: version-updates
+        update-types: ['minor', 'patch']
+        patterns:
+          - '@playwright/test'
+          - '@testing-library/*'
+          - '@types/jest'
+          - '@types/ws'
+          - eslint-plugin-jest
+          - jest
+          - jest-environment-jsdom
+          - js-yaml
+          - ts-jest
+          - ws
+
+  # No allow list here: we pin every action to a SHA while the template pins by
+  # tag, so no line Dependabot rewrites is a line the template also owns.
+  # Dependabot updates the SHA and the `# v1.2.3` comment beside it together.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      # Grouped for the same reason as the npm group above.
+      actions:
+        applies-to: version-updates
+        update-types: ['minor', 'patch']
+        patterns:
+          - '*'

.prettierignore

@@ -41,3 +41,7 @@ package-lock.json
 # Playwright test output
 e2e-tests/playwright-report
 e2e-tests/test-results
+
+# A verbatim copy of the template's manifest, kept byte-for-byte so `npm run template:baseline` can
+# write it straight from `git show` rather than a copy plus whatever our tooling would impose on it
+scripts/merged-template-package.json

.stylelintignore

@@ -41,3 +41,7 @@ package-lock.json
 # Playwright test output
 e2e-tests/playwright-report
 e2e-tests/test-results
+
+# A verbatim copy of the template's manifest, kept byte-for-byte so `npm run template:baseline` can
+# write it straight from `git show` rather than a copy plus whatever our tooling would impose on it
+scripts/merged-template-package.json

AGENTS.md

@@ -14,7 +14,7 @@ npm run build:web-view   # Build React WebView only
 npm run watch            # Continuous rebuild on changes
 
 # Lint & Format
-npm run lint             # Run ESLint + stylelint + tsc --noEmit
+npm run lint             # Run ESLint + stylelint + tsc --noEmit + dependency scope
 npm run lint-fix         # Auto-fix linting issues
 npm run format           # Format with Prettier
 
@@ -25,6 +25,8 @@ npm test -- path/to/file.test.ts                 # Run a single test file
 npm test -- --testNamePattern="pattern"          # Run tests matching name
 ```
 
+Only a template merge moves the dependency baseline `npm run lint:dependencies` checks against; refresh it in that same commit with `npm run template:baseline`, which writes both the copy and the `MERGED_TEMPLATE_COMMIT` id recorded beside it in [scripts/check-dependency-scope.cjs](scripts/check-dependency-scope.cjs). [README.md](README.md) has the full procedure.
+
 ## Architecture
 
 This is a **Platform.Bible extension** for interlinear Bible text alignment. Platform.Bible (PAPI) is an Electron-based application; extensions run in a sandboxed context and communicate with the host via `papi.*` APIs.

README.md

@@ -317,6 +317,14 @@ git fetch template
 git merge template/main --allow-unrelated-histories
 ```
 
+Merging is also what moves the baseline `npm run lint:dependencies` compares dependency versions against, so in the same commit refresh that baseline from the template you just merged:
+
+```bash
+npm run template:baseline
+```
+
+Run that before fetching the template again, so the baseline records the state you actually merged. It writes both the copy and the `MERGED_TEMPLATE_COMMIT` id recorded beside it in [`scripts/check-dependency-scope.cjs`](scripts/check-dependency-scope.cjs), so the two cannot drift apart. Nothing resolves that id — it is there so the check's output names a template state you can go and look at.
+
 For more information, read [the instructions on the wiki](https://github.com/paranext/paranext-extension-template/wiki/Merging-Template-Changes-into-Your-Extension).
 
 After updating this extension from the template, clear all temp/cache files and regenerate the extension's `package-lock.json` with this command:
@@ -327,6 +335,8 @@ npm run core:reinstall
 
 **Note:** The merge/squash commits created when updating this repo from the template are important; Git uses them to compare the files for future updates. If you edit this repo's Git history, please preserve these commits (do not squash them, for example) to avoid duplicated merge conflicts in the future.
 
+Dependabot covers only the packages this extension adds on top of the template, so that its updates never move a template-owned dependency ahead of the template. `npm run lint:dependencies` enforces that split: it compares `package.json` against the template's and reports any package whose version range has drifted, plus any mismatch between the extension's own packages and the allow list in [`.github/dependabot.yml`](.github/dependabot.yml), whose grouping patterns and allow list it holds to each other: a departing package cannot leave its grouping line behind, and a dev dependency this extension adds cannot slip out of the group that spares it a pull request of its own. Entries on the allow and ignore lists are literal package names: the check reports an entry it cannot read that way — a wildcard, or one selecting packages by dependency type — rather than guessing at what it covers. A version range this extension holds apart from the template's on purpose belongs in the recorded list at the top of [`scripts/check-dependency-scope.cjs`](scripts/check-dependency-scope.cjs). The template side of the comparison is [`scripts/merged-template-package.json`](scripts/merged-template-package.json), a verbatim copy of the template's manifest as of the commit this repo last merged, so a range difference means this extension moved the range: bumps the template makes between merges are ours to pick up at the next merge rather than a lint failure to fix now. Only a template merge moves that baseline; Dependabot's own updates never do, because its allow list covers only packages the template does not own.
+
 ## Special features in this project
 
 This project has special features and specific configuration to make building an extension for Platform.Bible easier. Rather than duplicating the full explanation here, please refer to the [`Special Features in this project` section of the multi-extension template README](https://github.com/paranext/paranext-multi-extension-template?tab=readme-ov-file#special-features-in-this-project) for details on these features.

package.json

@@ -21,7 +21,8 @@
     "start": "cross-env MAIN_ARGS=\"--extensions $INIT_CWD/dist\" concurrently \"npm:watch\" \"npm:core:start\"",
     "start:cdp": "cross-env MAIN_ARGS=\"--extensions $INIT_CWD/dist --remote-debugging-port=9223\" concurrently \"npm:watch\" \"npm:core:start\"",
     "start:production": "cross-env MAIN_ARGS=\"--extensions $INIT_CWD/dist\" concurrently \"npm:watch:production\" \"npm:core:start\"",
-    "lint": "npm run lint:scripts && npm run lint:styles && npm run lint:typecheck",
+    "lint": "npm run lint:scripts && npm run lint:styles && npm run lint:typecheck && npm run lint:dependencies",
+    "lint:dependencies": "node ./scripts/check-dependency-scope.cjs",
     "lint:scripts": "cross-env NODE_ENV=development eslint --ext .cjs,.js,.jsx,.ts,.tsx --cache .",
     "lint:styles": "stylelint **/*.{css,scss} --allow-empty-input",
     "lint:typecheck": "tsc --noEmit",
@@ -40,7 +41,8 @@
     "core:reinstall": "npm run core:stop && node ./scripts/delete-temp-files.cjs --all && npm run core:update && npm i",
     "core:install": "npm --prefix ../paranext-core install",
     "core:pull": "git -C ../paranext-core pull --ff-only",
-    "core:update": "npm run core:pull && npm run core:install"
+    "core:update": "npm run core:pull && npm run core:install",
+    "template:baseline": "node ./scripts/refresh-template-baseline.cjs"
   },
   "browserslist": [],
   "peerDependencies": {
@@ -95,6 +97,7 @@
     "glob": "^10.5.0",
     "jest": "^30.2.0",
     "jest-environment-jsdom": "^30.2.0",
+    "js-yaml": "^4.3.0",
     "lucide-react": "^1.8.0",
     "papi-dts": "file:../paranext-core/lib/papi-dts",
     "platform-bible-react": "file:../paranext-core/lib/platform-bible-react",