From 59230f76dabeb6a87dcb9448811f28d24b4afa4a Mon Sep 17 00:00:00 2001 From: nicodes Date: Sat, 17 Oct 2026 16:43:55 +0200 Subject: [PATCH] Standardize verified dependency updates and reviewed action pins --- .github/dependabot.yml | 86 +++++++++++++++++++++++++------- .github/dependency-policy.json | 31 ++++++++++++ .github/workflows/ci.yml | 15 +++++- .github/workflows/dependabot.yml | 28 ++++------- .gitignore | 3 ++ 5 files changed, 128 insertions(+), 35 deletions(-) create mode 100644 .github/dependency-policy.json diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 1f74278..c7982d9 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,19 +1,71 @@ -# Keeps the pinned `uses:` refs in .github/workflows and .github/actions current. -# -# Every third-party action here is pinned to a commit SHA rather than a tag, -# which is the point: a tag is a moving reference, and whoever can move it can -# run code in these jobs. The cost of a SHA is that nothing tells you when it -# has gone stale -- a tag at least reads as a version. This is the thing that -# tells you. -# -# No groups: the shared gate (scripts/engineering/helpers/dependency-policy.py) -# never passes a grouped update -- several dependencies cannot be judged as one -# routine change -- so a group would only sit waiting for review. One pull -# request per dependency keeps each merge attributable; major updates remain -# their own reviewable pull requests either way. version: 2 updates: - - package-ecosystem: github-actions - directory: / - schedule: - interval: weekly +- package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + day: monday + time: 09:53 + timezone: Etc/UTC + open-pull-requests-limit: 5 + cooldown: + default-days: 3 + groups: + routine-updates: + patterns: + - '*' + exclude-patterns: + - nicodes/tools/* + - nicodes/cicd/* + - nicodes/komizo-actions/* + - aviorstudio/gdam-actions/* + - '*clerk*' + - '*pocketbase*' + - '*crypto*' + - '*jsonwebtoken*' + - '*jose*' + - '*oauth*' + - '*openid*' + - '*passport*' + - '*bcrypt*' + - '*argon2*' + - '@noble/*' + - '*prisma*' + - '*drizzle*' + - '*migrate*' + - '@astrojs/check' + update-types: + - minor + - patch + managed-releases: + patterns: + - nicodes/tools/* + - nicodes/cicd/* + - nicodes/komizo-actions/* + - aviorstudio/gdam-actions/* + update-types: + - minor + - patch + security-fixes: + applies-to: security-updates + patterns: + - '*' + exclude-patterns: + - nicodes/tools/* + - nicodes/cicd/* + - nicodes/komizo-actions/* + - aviorstudio/gdam-actions/* + - '*clerk*' + - '*pocketbase*' + - '*crypto*' + - '*jsonwebtoken*' + - '*jose*' + - '*oauth*' + - '*openid*' + - '*passport*' + - '*bcrypt*' + - '*argon2*' + - '@noble/*' + - '*prisma*' + - '*drizzle*' + - '*migrate*' diff --git a/.github/dependency-policy.json b/.github/dependency-policy.json new file mode 100644 index 0000000..8edb37f --- /dev/null +++ b/.github/dependency-policy.json @@ -0,0 +1,31 @@ +{ + "version": 1, + "mode": "auto", + "ci_workflow": "ci.yml", + "required_checks": ["Build", "Test"], + "integration_job": "build", + "dispatch_workflow": "ci.yml", + "max_group_size": 10, + "managed_dependencies": [ + "nicodes/tools/*", + "nicodes/cicd/*", + "nicodes/komizo-actions/*", + "aviorstudio/gdam-actions/*" + ], + "sensitive_dependencies": [ + "*clerk*", + "*pocketbase*", + "*crypto*", + "*jsonwebtoken*", + "*jose*", + "*oauth*", + "*openid*", + "*passport*", + "*bcrypt*", + "*argon2*", + "@noble/*", + "*prisma*", + "*drizzle*", + "*migrate*" + ] +} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c3514ca..525c6ec 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,8 +19,21 @@ jobs: steps: - name: "Check out source" uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - name: Record tested integration identity + if: github.event_name == 'pull_request' + uses: nicodes/tools/integration-identity@ca747e13a51f301f51635c262d883d57d6084ae3 # v0.27.1 + env: + EXPECTED_HEAD: ${{ github.event.pull_request.head.sha }} + - name: Upload artifacts + if: github.event_name == 'pull_request' + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + with: + name: fleet-integration-${{ github.run_id }}-${{ github.run_attempt }} + path: .artifacts/fleet-integration.json + if-no-files-found: error + retention-days: 7 - name: "Set up tools" - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 + uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2 - name: Build uses: ./.github/actions/build - name: Test diff --git a/.github/workflows/dependabot.yml b/.github/workflows/dependabot.yml index bc3130c..3102fb5 100644 --- a/.github/workflows/dependabot.yml +++ b/.github/workflows/dependabot.yml @@ -1,31 +1,25 @@ -name: "Dependency Policy" - -# Thin caller: the gate body is the shared reusable workflow in nicodes/tools, -# pinned by full commit SHA. The policy scripts it runs come from this -# shared workflow's independently pinned helper checkout -- never the -# PR head. This site deploys via Vercel -# and has no cd.yml, so merged-main coverage is dispatched onto ci.yml. +name: Dependency Policy on: pull_request_target: types: [opened, synchronize, reopened, ready_for_review] - -# The called workflow can only downgrade these, never elevate them; omitting -# the block would fall back to the repository's read-only default. + workflow_run: + workflows: ["Build & Test"] + types: [completed] + workflow_dispatch: + schedule: + - cron: '53 6 * * *' permissions: contents: write pull-requests: write actions: write checks: read statuses: read - concurrency: - group: dependabot-${{ github.event.pull_request.number }} - cancel-in-progress: true - + group: dependency-policy + cancel-in-progress: false jobs: auto-merge: - name: "Apply dependency policy" - uses: nicodes/tools/.github/workflows/dependabot.yml@77049b34c6a67ccbc256fe6bad033973d5ca513b # v0.11.1 + name: Apply dependency policy + uses: nicodes/tools/.github/workflows/dependency-merge.yml@ca747e13a51f301f51635c262d883d57d6084ae3 # v0.27.1 with: runner: blacksmith-2vcpu-ubuntu-2404 - dispatch-target: ci.yml diff --git a/.gitignore b/.gitignore index 016b59e..3a0116f 100644 --- a/.gitignore +++ b/.gitignore @@ -22,3 +22,6 @@ pnpm-debug.log* # jetbrains setting folder .idea/ + +# Generated CI evidence +.artifacts/