From 326b8a907a2b70ed195c66061498eaa950ede368 Mon Sep 17 00:00:00 2001 From: Astrid Gealer Date: Mon, 26 Oct 2026 08:55:40 +0000 Subject: [PATCH] chore(ci): add Dependabot version updates and a CODEOWNERS file The owner chose (D19, from the CI-policy question in #1307) to turn on Dependabot version updates and add a CODEOWNERS file, while Snyk, Trivy and the coverage threshold stay advisory. dependabot.yml schedules weekly updates for the root Go module, the separate tests/e2e module, frontend npm, the SHA-pinned workflow actions and the digest-pinned Dockerfile base images. Minor and patch updates are grouped per ecosystem and each ecosystem is capped at 5 open PRs to keep the volume reviewable. A 7-day cooldown keeps brand-new releases out until they have had time to be yanked; zizmor's dependabot-cooldown audit flags its absence at medium severity. CODEOWNERS assigns everything to @cristim. The ruleset does not require code-owner review, so this only auto-requests reviews. Co-Authored-By: Claude Opus 5.5 --- .github/CODEOWNERS | 4 ++ .github/dependabot.yml | 104 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 108 insertions(+) create mode 100644 .github/CODEOWNERS create mode 100644 .github/dependabot.yml diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 000000000..908addf8b --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,4 @@ +# Requests review from the maintainer on every PR. The ruleset does not +# require code-owner review, so this only auto-requests reviews; it does not +# block merges. +* @cristim diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000..eb71aa07c --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,104 @@ +# Dependabot version updates (owner decision D19, from the CI-policy +# question in #1307). Security alerts are a separate setting; this file only +# schedules version-update PRs. +# +# Minor and patch updates are grouped into one PR per ecosystem, and each +# ecosystem opens at most 5 PRs at a time, so the weekly run stays reviewable. +# Major updates still arrive one PR per dependency, because they are the ones +# that need reading. +# +# cooldown holds back a release until it is 7 days old, so a compromised or +# yanked version has time to be caught before Dependabot proposes it. +version: 2 + +updates: + # Root Go module. + - package-ecosystem: gomod + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 + cooldown: + default-days: 7 + commit-message: + prefix: chore(deps) + labels: + - type/chore + groups: + gomod-minor-patch: + update-types: + - minor + - patch + + # tests/e2e is its own module, excluded from the root module on purpose. + - package-ecosystem: gomod + directory: /tests/e2e + schedule: + interval: weekly + open-pull-requests-limit: 5 + cooldown: + default-days: 7 + commit-message: + prefix: chore(deps) + labels: + - type/chore + groups: + e2e-gomod-minor-patch: + update-types: + - minor + - patch + + - package-ecosystem: npm + directory: /frontend + schedule: + interval: weekly + open-pull-requests-limit: 5 + cooldown: + default-days: 7 + commit-message: + prefix: chore(deps) + labels: + - type/chore + groups: + npm-minor-patch: + update-types: + - minor + - patch + + # Workflow actions are pinned by commit SHA with a version comment; + # Dependabot bumps the SHA and the comment together. + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 + cooldown: + default-days: 7 + commit-message: + prefix: chore(ci) + labels: + - type/chore + groups: + actions-minor-patch: + update-types: + - minor + - patch + + # Dockerfile, Dockerfile.dev and Dockerfile.test pin base images by tag + # and digest; Dependabot updates both. + - package-ecosystem: docker + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 + cooldown: + default-days: 7 + commit-message: + prefix: chore(deps) + labels: + - type/chore + groups: + docker-minor-patch: + update-types: + - minor + - patch