chore: dependabot grouped updates, cooldowns & CI hardening - #18
chore: dependabot grouped updates, cooldowns & CI hardening#18hackertron wants to merge 1 commit into
Conversation
…hardening Configure Dependabot with grouped security/version updates per ecosystem (npm, pip, github-actions) to reduce PR noise. Add 7-14 day cooldown periods to mitigate supply chain attacks (e.g. axios@1.14.1 incident). Harden CI with npm ci --ignore-scripts to block postinstall hook attacks.
📝 WalkthroughWalkthroughAdded Dependabot configuration for automated weekly dependency updates across npm and pip ecosystems plus GitHub Actions, and modified the CI workflow to skip npm install scripts during dependency installation. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/dependabot.yml:
- Line 14: The dependabot config sets semver-patch-days to 3 which violates the
7–14 day cooldown policy; update the semver-patch-days value (the YAML key
"semver-patch-days") to a value within the 7–14 range (e.g., 7) and ensure any
duplicate occurrences (the other "semver-patch-days" entry referenced in the
review) are updated consistently.
- Around line 61-69: Update the github-actions dependabot block to enforce
cooldown and add a security group: inside the existing package-ecosystem:
"github-actions" section (the github-actions block that contains schedule and
groups/actions-all), add a cooldown setting (e.g., cooldown: "1d") and extend
the groups map with a security-focused group (e.g., a new key like
security-updates that sets applies-to: security and appropriate patterns) so
security updates are grouped separately from the existing actions-all group.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: af4d00c6-73cf-49dc-a63f-082c536d8973
📒 Files selected for processing (2)
.github/dependabot.yml.github/workflows/ci.yml
| default-days: 7 | ||
| semver-major-days: 14 | ||
| semver-minor-days: 7 | ||
| semver-patch-days: 3 |
There was a problem hiding this comment.
Patch cooldown is below the stated 7–14 day policy.
semver-patch-days is set to 3, which does not match the PR objective of a 7–14 day cooldown window.
🔧 Suggested patch
cooldown:
default-days: 7
semver-major-days: 14
semver-minor-days: 7
- semver-patch-days: 3
+ semver-patch-days: 7
@@
cooldown:
default-days: 7
semver-major-days: 14
semver-minor-days: 7
- semver-patch-days: 3
+ semver-patch-days: 7Also applies to: 42-42
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/dependabot.yml at line 14, The dependabot config sets
semver-patch-days to 3 which violates the 7–14 day cooldown policy; update the
semver-patch-days value (the YAML key "semver-patch-days") to a value within the
7–14 range (e.g., 7) and ensure any duplicate occurrences (the other
"semver-patch-days" entry referenced in the review) are updated consistently.
| - package-ecosystem: "github-actions" | ||
| directory: "/" | ||
| schedule: | ||
| interval: "weekly" | ||
| day: "monday" | ||
| groups: | ||
| actions-all: | ||
| applies-to: version-updates | ||
| patterns: ["*"] |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
In GitHub Dependabot configuration, for package-ecosystem "github-actions", confirm whether both "cooldown" and groups with "applies-to: security-updates" are supported.
💡 Result:
Yes, both "cooldown" and groups with "applies-to: security-updates" are supported for the package-ecosystem "github-actions" in GitHub Dependabot configuration. For "cooldown": Official GitHub documentation lists "github-actions" in the table of supported package ecosystems for the cooldown feature (under version updates, as cooldown does not apply to security updates). Additionally, GitHub issue #13039 in dependabot-core confirms support, with a maintainer stating it supports "github-actions". Examples in third-party docs like OpenRewrite also include "github-actions" with cooldown. For groups with "applies-to: security-updates": The "groups" option is available under each package-ecosystem entry, including "github-actions". The "applies-to" parameter supports "security-updates", and GitHub documentation confirms groups apply per package ecosystem without exclusions for "github-actions". Security updates are supported for GitHub Actions, as Dependabot can raise PRs for vulnerable actions, and grouping is a standard configuration option that inherits to security updates.
Citations:
- 1: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
- 2: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/optimizing-pr-creation-version-updates
- 3: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
- 4: Error: cooldown is not supported for the package ecosystem 'swift'. dependabot/dependabot-core#13039
- 5: https://github.blog/changelog/2024-03-06-group-configuration-options-for-dependabot-security-updates-public-beta
- 6: https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates
- 7: https://docs.github.com/en/code-security/dependabot/ecosystems-supported-by-dependabot/supported-ecosystems-and-repositories
Add cooldown and security grouping to github-actions configuration.
The github-actions block currently lacks both cooldown enforcement and security update grouping. To match the hardening applied to npm/pip, add:
Suggested configuration
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
+ cooldown:
+ default-days: 7
+ semver-major-days: 14
+ semver-minor-days: 7
+ semver-patch-days: 7
groups:
+ actions-security:
+ applies-to: security-updates
+ patterns: ["*"]
actions-all:
applies-to: version-updates
patterns: ["*"]📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - package-ecosystem: "github-actions" | |
| directory: "/" | |
| schedule: | |
| interval: "weekly" | |
| day: "monday" | |
| groups: | |
| actions-all: | |
| applies-to: version-updates | |
| patterns: ["*"] | |
| - package-ecosystem: "github-actions" | |
| directory: "/" | |
| schedule: | |
| interval: "weekly" | |
| day: "monday" | |
| cooldown: | |
| default-days: 7 | |
| semver-major-days: 14 | |
| semver-minor-days: 7 | |
| semver-patch-days: 7 | |
| groups: | |
| actions-security: | |
| applies-to: security-updates | |
| patterns: ["*"] | |
| actions-all: | |
| applies-to: version-updates | |
| patterns: ["*"] |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/dependabot.yml around lines 61 - 69, Update the github-actions
dependabot block to enforce cooldown and add a security group: inside the
existing package-ecosystem: "github-actions" section (the github-actions block
that contains schedule and groups/actions-all), add a cooldown setting (e.g.,
cooldown: "1d") and extend the groups map with a security-focused group (e.g., a
new key like security-updates that sets applies-to: security and appropriate
patterns) so security updates are grouped separately from the existing
actions-all group.
1 participant
Summary
dependabot.ymlwith grouped security and version updates per ecosystem (npm, pip, github-actions) — reduces 30+ individual PRs down to 2-3 grouped onesnpm ci --ignore-scriptsto block malicious postinstall hooksWhat this changes
.github/dependabot.yml.github/workflows/ci.ymlnpm ci→npm ci --ignore-scriptsRepo settings already configured
Test plan
npm ci --ignore-scriptsdoesn't break the web build in CISummary by CodeRabbit