From 683bc659a6b4802e6719e355cac5ca14933dfe92 Mon Sep 17 00:00:00 2001 From: Peter Permenter <41281403+TusanHomichi@users.noreply.github.com> Date: Thu, 15 Oct 2026 13:42:09 -0700 Subject: [PATCH] ci: update the pinned actions and keep dependencies current with Dependabot actions/checkout v6.0.2 -> v7.0.1, actions/cache v5.0.4 -> v6.1.0, and actions/attest-build-provenance v4.1.1 -> v4.2.2, still SHA-pinned; neither major affects our triggers or inputs (checkout v7 only refuses fork code under pull_request_target/workflow_run, which we do not use; cache v6 is an ESM rework with an identical action.yml). setup-node v7.1.0 is current. .github/dependabot.yml proposes weekly version updates for npm (web), cargo, and github-actions, minor and patch grouped and majors separate, after a 7-day cooldown; the two web holds (TypeScript 7, @types/node above the Node 22 floor) are ignore rules with their reasons. CONTRIBUTING states the dependency policy. Refs #137 Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 58 +++++++++++++++++++++++++++++++++++ .github/workflows/pr-gate.yml | 6 ++-- .github/workflows/release.yml | 8 ++--- CONTRIBUTING.md | 5 +++ 4 files changed, 70 insertions(+), 7 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..54b5745 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,58 @@ +# Dependency version updates. Holds are written down here with their reason; +# remove an ignore rule when its reason no longer applies. +version: 2 +updates: + - package-ecosystem: npm + directory: /web + schedule: + interval: weekly + # Supply-chain caution: do not adopt a release on the day it is published. + cooldown: + default-days: 7 + open-pull-requests-limit: 5 + commit-message: + prefix: deps(web) + groups: + web-minor-patch: + update-types: + - minor + - patch + ignore: + # TypeScript 7 has no JS API, svelte-check peers `^5 || ^6`, and the + # TypeScript 7 announcement says Svelte projects should stay on 6. + # Revisit when svelte-check supports 7 (hold recorded in #140). + - dependency-name: typescript + versions: [">=7"] + # Tracks the Node 22 floor in web/package.json `engines`. + - dependency-name: "@types/node" + versions: [">=23"] + + - package-ecosystem: cargo + directory: / + schedule: + interval: weekly + cooldown: + default-days: 7 + open-pull-requests-limit: 5 + commit-message: + prefix: deps(rust) + groups: + rust-minor-patch: + update-types: + - minor + - patch + + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + cooldown: + default-days: 7 + open-pull-requests-limit: 5 + commit-message: + prefix: ci + # Dependabot keeps the full-SHA pins and their `# vX.Y.Z` comments. + groups: + actions: + patterns: + - "*" diff --git a/.github/workflows/pr-gate.yml b/.github/workflows/pr-gate.yml index d72b450..f9840d4 100644 --- a/.github/workflows/pr-gate.yml +++ b/.github/workflows/pr-gate.yml @@ -22,7 +22,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 30 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false # Cheap repository guards run first so they fail in seconds. @@ -37,7 +37,7 @@ jobs: rustup toolchain install rustup show active-toolchain - name: Restore cargo cache - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: | ~/.cargo/registry @@ -45,7 +45,7 @@ jobs: target key: pr-gate-${{ runner.os }}-${{ hashFiles('rust-toolchain.toml', 'Cargo.lock') }} - name: Restore npm cache - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 with: path: ~/.npm key: pr-gate-npm-${{ runner.os }}-${{ hashFiles('web/package-lock.json') }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index dd1bdf4..f1e6818 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -39,7 +39,7 @@ jobs: target: aarch64-unknown-linux-musl arch: aarch64 steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Tag matches the Cargo version @@ -215,7 +215,7 @@ jobs: # commit (ADR 0026); verify with `gh attestation verify`. - name: Attest build provenance if: startsWith(github.ref, 'refs/tags/v') - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: | dist/consolebook-linux-${{ matrix.arch }}.tar.gz @@ -235,7 +235,7 @@ jobs: id-token: write attestations: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false # The one-line install fetches the installer from the release, not from @@ -252,7 +252,7 @@ jobs: sha256sum install.sh > install.sh.sha256 gh release upload "$GITHUB_REF_NAME" --clobber install.sh install.sh.sha256 - name: Attest installer provenance - uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-path: | install.sh diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 77719fa..9a3676b 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -35,6 +35,11 @@ GitHub enforces the following; the `main` ruleset is the rung-2 guard for `uses:` fails before it runs. Secret scanning with push protection and CodeQL code scanning are enabled. +Dependencies move to their latest stable release where it makes sense; any +hold is written down with its reason, as the `.github/dependabot.yml` ignore +rules are. Dependabot proposes grouped weekly version updates after a 7-day +cooldown, and security updates as advisories appear. + Use [the evidence-driven workflow](docs/workflow.md) for outcome definition, roles and ownership, task graphs, evidence-driven continuation, and authorization. The primary issue body owns the live graph; issue comments archive completed