红尘
d73ff9b0fb
Deploy Site / deploy-vercel (push) Has been cancelled
Deploy Site / deploy-docs (push) Has been cancelled
Docker / shell lint / Lint Dockerfile (hadolint) (push) Has been cancelled
Docker / shell lint / Lint docker/ shell scripts (shellcheck) (push) Has been cancelled
Docker Build and Publish / build-amd64 (push) Has been cancelled
Docker Build and Publish / build-arm64 (push) Has been cancelled
Lint (ruff + ty) / ruff + ty diff (push) Has been cancelled
Lint (ruff + ty) / ruff enforcement (blocking) (push) Has been cancelled
Lint (ruff + ty) / Windows footguns (blocking) (push) Has been cancelled
Nix Lockfile Fix / auto-fix-main (push) Has been cancelled
Nix Lockfile Fix / fix (push) Has been cancelled
Nix / nix (macos-latest) (push) Has been cancelled
Nix / nix (ubuntu-latest) (push) Has been cancelled
OSV-Scanner / Scan lockfiles (push) Has been cancelled
Build Skills Index / build-index (push) Has been cancelled
Tests / test (1) (push) Has been cancelled
Tests / test (2) (push) Has been cancelled
Tests / test (3) (push) Has been cancelled
Tests / test (4) (push) Has been cancelled
Tests / test (5) (push) Has been cancelled
Tests / test (6) (push) Has been cancelled
Tests / e2e (push) Has been cancelled
uv.lock check / uv lock --check (push) Has been cancelled
Docker Build and Publish / merge (push) Has been cancelled
Build Skills Index / trigger-deploy (push) Has been cancelled
Tests / save-durations (push) Has been cancelled
45 lines
1.7 KiB
YAML
45 lines
1.7 KiB
YAML
# Dependabot configuration for hermes-agent.
|
|
#
|
|
# Deliberately scoped to github-actions only.
|
|
#
|
|
# We do NOT enable Dependabot for pip / npm / any source-dependency ecosystem
|
|
# because we pin source dependencies exactly (uv.lock, package-lock.json) as
|
|
# part of our supply-chain posture. Automatic version-bump PRs against those
|
|
# pins would undermine the strategy — pins are moved deliberately, after
|
|
# review, not on a schedule.
|
|
#
|
|
# github-actions is the exception: action pins (we use full commit SHAs per
|
|
# supply-chain policy) must be updated when upstream actions publish
|
|
# patches — usually themselves security fixes. Dependabot opens a PR with
|
|
# the new SHA and release notes; we review and merge like any other PR.
|
|
#
|
|
# Security-update PRs for source dependencies (opened ONLY when a CVE is
|
|
# published affecting a currently-pinned version) are enabled separately
|
|
# via the repo's Dependabot security updates setting
|
|
# (Settings → Code security → Dependabot → Dependabot security updates).
|
|
# Those are CVE-only, not schedule-driven, and do not conflict with our
|
|
# pinning strategy — they fire when a pinned version becomes known-bad,
|
|
# which is exactly when we want to move the pin.
|
|
|
|
version: 2
|
|
updates:
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
open-pull-requests-limit: 5
|
|
labels:
|
|
- "dependencies"
|
|
- "github-actions"
|
|
commit-message:
|
|
prefix: "chore(actions)"
|
|
include: "scope"
|
|
groups:
|
|
# Batch routine action bumps into one PR per week to reduce noise.
|
|
# Security updates still open individually and bypass grouping.
|
|
actions-minor-patch:
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|