From 5e1cf62955fe3c4511732393dab38e978187ea3f Mon Sep 17 00:00:00 2001 From: nicodes Date: Sat, 17 Oct 2026 16:46:08 +0200 Subject: [PATCH] Standardize verified dependency updates and reviewed action pins --- .github/actions/test/action.yml | 4 +- .github/dependabot.yml | 157 ++++++++++++++++++++++++++----- .github/dependency-policy.json | 33 +++++++ .github/workflows/ci.yml | 17 +++- .github/workflows/dependabot.yml | 46 ++++----- .github/workflows/release.yml | 8 +- .mise.toml | 2 +- engineering-pin.json | 4 +- 8 files changed, 211 insertions(+), 60 deletions(-) create mode 100644 .github/dependency-policy.json diff --git a/.github/actions/test/action.yml b/.github/actions/test/action.yml index 5ad8a54..8ccdb14 100644 --- a/.github/actions/test/action.yml +++ b/.github/actions/test/action.yml @@ -4,7 +4,7 @@ runs: using: composite steps: - name: Cache verified Godot archives - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: .artifacts/godot/archives key: gd-playwright-${{ runner.os }}-${{ runner.arch }}-godot-builds-4.7.2-sha512-9aa00f7a60520094-ca4d71c4d7b81dfc @@ -15,7 +15,7 @@ runs: shell: bash run: make check - name: "Upload artifacts" - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: gd-web-evidence-${{ github.run_id }}-${{ github.job }} path: dist/web-export-evidence/ diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b154457..7f895b3 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,24 +1,137 @@ -# Keeps the pinned `uses:` refs in .github/workflows and .github/actions current. -# -# Every third-party action here is pinned to a commit SHA rather than a tag, -# which is the point: a tag is a moving reference, and whoever can move it can -# run code in these jobs. The cost of a SHA is that nothing tells you when it -# has gone stale -- a tag at least reads as a version. This is the thing that -# tells you. -# -# Minor and patch updates are grouped: they share the same risk profile and CI -# can merge them without ceremony. Major updates are deliberately excluded, so -# Dependabot opens one reviewable pull request for each breaking-change boundary. version: 2 updates: - - package-ecosystem: github-actions - directory: / - schedule: - interval: weekly - groups: - actions-minor-patch: - patterns: - - "*" - update-types: - - minor - - patch +- package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + day: monday + time: 09:20 + timezone: Etc/UTC + groups: + routine-updates: + patterns: + - '*' + exclude-patterns: + - nicodes/tools/* + - nicodes/cicd/* + - nicodes/komizo-actions/* + - aviorstudio/gdam-actions/* + - '*clerk*' + - '*pocketbase*' + - '*crypto*' + - '*jsonwebtoken*' + - '*jose*' + - '*oauth*' + - '*openid*' + - '*passport*' + - '*bcrypt*' + - '*argon2*' + - '@noble/*' + - '*prisma*' + - '*drizzle*' + - '*migrate*' + - '@playwright/cli' + update-types: + - minor + - patch + managed-releases: + patterns: &id001 + - nicodes/tools/* + - nicodes/cicd/* + - nicodes/komizo-actions/* + - aviorstudio/gdam-actions/* + update-types: + - minor + - patch + security-fixes: + applies-to: security-updates + patterns: + - '*' + exclude-patterns: + - nicodes/tools/* + - nicodes/cicd/* + - nicodes/komizo-actions/* + - aviorstudio/gdam-actions/* + - '*clerk*' + - '*pocketbase*' + - '*crypto*' + - '*jsonwebtoken*' + - '*jose*' + - '*oauth*' + - '*openid*' + - '*passport*' + - '*bcrypt*' + - '*argon2*' + - '@noble/*' + - '*prisma*' + - '*drizzle*' + - '*migrate*' + open-pull-requests-limit: 5 + cooldown: + default-days: 3 +- package-ecosystem: gomod + directories: + - /cli + schedule: + interval: weekly + day: monday + time: 09:20 + timezone: Etc/UTC + open-pull-requests-limit: 5 + cooldown: + default-days: 3 + groups: + routine-updates: + patterns: + - '*' + exclude-patterns: + - nicodes/tools/* + - nicodes/cicd/* + - nicodes/komizo-actions/* + - aviorstudio/gdam-actions/* + - '*clerk*' + - '*pocketbase*' + - '*crypto*' + - '*jsonwebtoken*' + - '*jose*' + - '*oauth*' + - '*openid*' + - '*passport*' + - '*bcrypt*' + - '*argon2*' + - '@noble/*' + - '*prisma*' + - '*drizzle*' + - '*migrate*' + - '@playwright/cli' + update-types: + - minor + - patch + managed-releases: + patterns: *id001 + update-types: + - minor + - patch + security-fixes: + applies-to: security-updates + patterns: + - '*' + exclude-patterns: + - nicodes/tools/* + - nicodes/cicd/* + - nicodes/komizo-actions/* + - aviorstudio/gdam-actions/* + - '*clerk*' + - '*pocketbase*' + - '*crypto*' + - '*jsonwebtoken*' + - '*jose*' + - '*oauth*' + - '*openid*' + - '*passport*' + - '*bcrypt*' + - '*argon2*' + - '@noble/*' + - '*prisma*' + - '*drizzle*' + - '*migrate*' diff --git a/.github/dependency-policy.json b/.github/dependency-policy.json new file mode 100644 index 0000000..dbde4ba --- /dev/null +++ b/.github/dependency-policy.json @@ -0,0 +1,33 @@ +{ + "version": 1, + "mode": "auto", + "ci_workflow": "ci.yml", + "required_checks": [ + "Test" + ], + "integration_job": "ci", + "dispatch_workflow": "ci.yml", + "max_group_size": 10, + "managed_dependencies": [ + "nicodes/tools/*", + "nicodes/cicd/*", + "nicodes/komizo-actions/*", + "aviorstudio/gdam-actions/*" + ], + "sensitive_dependencies": [ + "*clerk*", + "*pocketbase*", + "*crypto*", + "*jsonwebtoken*", + "*jose*", + "*oauth*", + "*openid*", + "*passport*", + "*bcrypt*", + "*argon2*", + "@noble/*", + "*prisma*", + "*drizzle*", + "*migrate*" + ] +} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6d409c1..40cf02d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -30,12 +30,25 @@ jobs: # comment so the version is still readable. A tag is a moving reference: # whoever can move it can run code in this job. - name: "Check out source" - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false + - name: Record tested integration identity + if: github.event_name == 'pull_request' + uses: nicodes/tools/integration-identity@ca747e13a51f301f51635c262d883d57d6084ae3 # v0.27.1 + env: + EXPECTED_HEAD: ${{ github.event.pull_request.head.sha }} + - name: Upload artifacts + if: github.event_name == 'pull_request' + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 + with: + name: fleet-integration-${{ github.run_id }}-${{ github.run_attempt }} + path: .artifacts/fleet-integration.json + if-no-files-found: error + retention-days: 7 - name: "Set up tools" - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 + uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2 with: install_args: go bun node python actionlint shellcheck http:cicd-engineering diff --git a/.github/workflows/dependabot.yml b/.github/workflows/dependabot.yml index ca90c97..b0d066c 100644 --- a/.github/workflows/dependabot.yml +++ b/.github/workflows/dependabot.yml @@ -1,33 +1,25 @@ -name: "Dependency Policy" - -# Dependabot's minor and patch action updates are grouped in dependabot.yml. -# Once the required CI check passes, this marks only those low-risk updates for -# squash merge. Major updates never satisfy the condition and remain manual. +name: Dependency Policy on: - pull_request: - + pull_request_target: + types: [opened, synchronize, reopened, ready_for_review] + workflow_run: + workflows: ["Build & Test"] + types: [completed] + workflow_dispatch: + schedule: + - cron: '20 6 * * *' permissions: contents: write pull-requests: write - + actions: write + checks: read + statuses: read +concurrency: + group: dependency-policy + cancel-in-progress: false jobs: auto-merge: - name: "Apply dependency policy" - if: github.event.pull_request.user.login == 'dependabot[bot]' - runs-on: blacksmith-2vcpu-ubuntu-2404 - timeout-minutes: 10 - steps: - - name: "Read dependency metadata" - id: metadata - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 - with: - github-token: ${{ secrets.GITHUB_TOKEN }} - - - name: Enable auto-merge for minor and patch updates - if: >- - steps.metadata.outputs.update-type == 'version-update:semver-minor' || - steps.metadata.outputs.update-type == 'version-update:semver-patch' - run: gh pr merge --auto --squash "$PR_URL" - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - PR_URL: ${{ github.event.pull_request.html_url }} + name: Apply dependency policy + uses: nicodes/tools/.github/workflows/dependency-merge.yml@ca747e13a51f301f51635c262d883d57d6084ae3 # v0.27.1 + with: + runner: blacksmith-2vcpu-ubuntu-2404 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index dd0e91e..667903c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,13 +28,13 @@ jobs: version: ${{ steps.release.outputs.version }} steps: - name: "Check out source" - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false - name: "Set up tools" - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1 + uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2 with: install_args: go bun node python actionlint shellcheck http:cicd-engineering @@ -118,7 +118,7 @@ jobs: fi - name: "Upload artifacts" - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: name: release-assets-${{ github.sha }}-${{ inputs.target }} path: release-assets/ @@ -134,7 +134,7 @@ jobs: timeout-minutes: 10 steps: - name: "Download artifacts" - uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0 + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: name: release-assets-${{ github.sha }}-${{ inputs.target }} path: dist diff --git a/.mise.toml b/.mise.toml index 0c9075b..bd3544e 100644 --- a/.mise.toml +++ b/.mise.toml @@ -5,4 +5,4 @@ node = "24.18.1" python = "3.13.11" actionlint = "1.7.12" shellcheck = "0.11.0" -"http:cicd-engineering" = { version = "0.14.1", url = "https://github.com/nicodes/tools/releases/download/v{{ version }}/cicd-engineering-v{{ version }}.tar.gz", checksum = "sha256:9337b7ff9c7ec47effe05560aa8cfb818a47b8f064364305cbb3fea69f797a28" } +"http:cicd-engineering" = { version = "0.27.1", url = "https://github.com/nicodes/tools/releases/download/v{{ version }}/cicd-engineering-v{{ version }}.tar.gz", checksum = "sha256:b227f07d191675b2383fb8ef425536383a2394f2d2be0c3faef4a751c522b8e4" } diff --git a/engineering-pin.json b/engineering-pin.json index a77d76a..6076974 100644 --- a/engineering-pin.json +++ b/engineering-pin.json @@ -1,5 +1,5 @@ { "repository": "https://github.com/nicodes/tools", - "revision": "2c8aff0f2e7d8a850f68e60417bb4f7e5eda474e", - "source_sha256": "d759a529837b6835d3f67ae4b2b39200e6c870d5f43e5d6c4ddbeee080900d6f" + "revision": "ca747e13a51f301f51635c262d883d57d6084ae3", + "source_sha256": "4b432b4ac5ff4694f4f06b8f80767c5dc0a6de35e53839623c8c747b9b662230" }