nearmiss/.github/dependabot.yml at main · ghzhost/nearmiss · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
# Dependabot configuration — nearmiss
#
# Scope: keep the supply chain current without breaking reproducibility.
#
# Dependencies in this project are PINNED AND HASHED. `requirements.lock` (runtime only) and
# `requirements-dev.lock` (runtime + the full dev toolchain) are both generated, fully pinned,
# hashed lockfiles produced by `pip-compile --generate-hashes` (`make lock` / `make lock-dev`),
# committed at the repo root; CI installs from `requirements-dev.lock` with `--require-hashes`
# (FIX-11 from the 2026-07-05 remediation pass). `uv.lock` is also committed;
# whether to consolidate the whole toolchain onto `uv` instead of pip-tools remains an open,
# separate decision — not resolved by this pinning. GitHub Actions in this
# repo's workflows are SHA-pinned (every `uses:` carries a full commit SHA with
# a `# vN` version comment); Dependabot (this file) and Renovate
# (`renovate.json`, `helpers:pinGitHubActionDigestsToSemver`) both keep those
# pinned digests current. Dependabot proposes exact version bumps (and, for
# Python, a regenerated lockfile-hash bump); CI re-runs lint, mypy --strict,
# pytest, the accessibility checks, i18n gates, and `pip-audit --strict`
# (blocking, no `|| true`) on every PR, so an update only lands after the
# pipeline still reproduces (Hard Rule 5: open and reproducible end to end).
#
# Updates are grouped so a week's bumps arrive as a small number of reviewable
# PRs rather than one PR per package — this is a single-maintainer project and
# review bandwidth is the bottleneck.
#
# Security advisories are NOT throttled by the weekly schedule: Dependabot
# always opens security updates as soon as an advisory is published.

version: 2

updates:
  # Python — pip ecosystem (requirements.lock, pyproject.toml).
  # Versions stay pinned; Dependabot regenerates the hashes with each bump.
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "06:00"
      timezone: "Etc/UTC"
    # Delay version updates long enough for ecosystem compromise reports and
    # yanks to surface. Dependabot security updates remain immediate.
    cooldown:
      default-days: 7
    open-pull-requests-limit: 5
    versioning-strategy: "increase"
    labels:
      - "dependencies"
      - "python"
    commit-message:
      # Conventional Commits — keeps semver/changelog automation honest.
      prefix: "build"
      prefix-development: "chore"
      include: "scope"
    groups:
      python-production:
        applies-to: version-updates
        dependency-type: "production"
        update-types:
          - "minor"
          - "patch"
      python-development:
        applies-to: version-updates
        dependency-type: "development"
        update-types:
          - "minor"
          - "patch"
      python-security:
        applies-to: security-updates
        patterns:
          - "*"

  # GitHub Actions — SHA-pinned (full commit SHA + `# vN` comment) in
  # .github/workflows/. Dependabot (and Renovate) keep the pinned digest
  # current as upstream tags move.
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "06:00"
      timezone: "Etc/UTC"
    cooldown:
      default-days: 7
    open-pull-requests-limit: 5
    labels:
      - "dependencies"
      - "github-actions"
    commit-message:
      prefix: "ci"
      include: "scope"
    groups:
      actions-version-updates:
        applies-to: version-updates
        patterns:
          - "*"
      actions-security-updates:
        applies-to: security-updates
        patterns:
          - "*"