Skip to content

Refresh dependency locks monthly using nab - #242

Open
notatallshaw wants to merge 2 commits into
ci/deploy-lockfrom
ci/update-locks
Open

notatallshaw wants to merge 2 commits into
ci/deploy-lockfrom
ci/update-locks

Conversation

@notatallshaw

@notatallshaw notatallshaw commented Oct 14, 2026 •

Copy link
Copy Markdown
Collaborator

Add monthly and manual refreshes that update the development and deployment locks in one draft pull request. --upgrade advances the seven-day release cutoff, and a separate job starts CI for updates created with GITHUB_TOKEN.

Nab provides these source safeguards:

Safeguard Policy
Builds Remote builds are blocked by default. This configuration uses never to forbid local builds too, and selects only wheels.
VCS Cloning is blocked by default. Allowed schemes and repositories require explicit configuration; full commit pins are required by default.
Direct archives Require SHA-256, SHA-384, or SHA-512 hashes and verify the downloaded bytes.

The explicit CPython/PyPy matrix also produces one PEP 751 development lock. Nab itself uses truststore for HTTPS requests, so lock refreshes exercise this project.

@notatallshaw
notatallshaw added this pull request to stack #243 October 14, 2026 14:50
@notatallshaw notatallshaw changed the title Refresh development and deployment locks monthly Refresh dependency locks monthly using nab Oct 14, 2026
@notatallshaw
notatallshaw force-pushed the ci/update-locks branch 2 times, most recently from 0b88b94 to c5689a9 Compare October 14, 2026 22:17
@notatallshaw
notatallshaw marked this pull request as ready for review October 14, 2026 22:34
@notatallshaw
notatallshaw force-pushed the ci/update-locks branch 2 times, most recently from ec73f4f to 17ab60f Compare October 15, 2026 01:15

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant