From b5c08c94322fc78b1cc6b0d2f228ffcfb5d2fdc3 Mon Sep 17 00:00:00 2001 From: Mike Odnis Date: Sat, 15 Aug 2026 18:23:43 -0400 Subject: [PATCH] chore: add Dependabot config for NuGet and GitHub Actions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This repo pins everything by hand and had no mechanism to move any of it: 47 NuGet packages under Central Package Management, 11 actions pinned to commit SHAs, no dependabot.yml and no Renovate config. Pins without an updater are pins that rot — including security pins. That risk is not hypothetical here. Directory.Packages.props already carries a hand-written transitive pin forcing System.Text.Json off the vulnerable <=8.0.4 line (CVE-2024-43485 / GHSA-8g4q-xg66-9fp4). Someone had to notice that. This automates noticing the next one. Three update streams: nuget / root CPM. All versions live in one Directory.Packages.props, so bumps are edits to that single file. nuget /templates/resq-service the `dotnet new` template ships its own Directory.Packages.props and is restored outside the root tree (see NuGet.config), so the root scan never reaches it. Kept separate because template bumps change what downstream services scaffold with. github-actions / SHA pins. Dependabot updates them in place and rewrites the trailing `# vX.Y.Z` comment, so pins stay pins. Grouping is deliberate. Microsoft.Extensions/EF Core/AspNetCore ship as one versioned wave and fail to restore against each other if split. ResQ.BuildingBlocks.* are this repo's own packages, versioned together off one MinVer tag, so ungrouped they would open eight near-identical template PRs on every release. github/gh-aw-actions* is ignored: it is version-locked to the gh-aw compiler and rewritten into the *.lock.yml files by `gh aw compile`, so a bump here is reverted on the next compile. Verified: config parses as valid YAML v2; every group pattern was matched against the 47 package ids actually present, with zero dead patterns. The `chore` and `deps` labels were created first — a config naming labels that do not exist makes Dependabot refuse to label its PRs, which is exactly what happened in resq-software/docs#117. Co-Authored-By: Claude Opus 5 (1M context) --- .github/dependabot.yml | 104 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 104 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..f06957f --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,104 @@ +# Copyright 2026 ResQ Software +# SPDX-License-Identifier: Apache-2.0 +# +# Automated dependency updates. Every version in this repo is pinned by +# hand — 47 NuGet packages under Central Package Management, 11 actions +# pinned to commit SHAs — so without this file nothing ever moves, and +# security patches land only when someone notices. The System.Text.Json +# transitive pin in Directory.Packages.props (CVE-2024-43485) is what a +# manual catch looks like; this automates the next one. + +version: 2 + +updates: + # ---- NuGet: root solution (Central Package Management) -------------- + # ManagePackageVersionsCentrally means every version lives in + # Directory.Packages.props, so updates land as edits to that one file. + - package-ecosystem: nuget + directory: / + schedule: + interval: weekly + day: monday + time: "06:17" + open-pull-requests-limit: 5 + labels: + - chore + - deps + groups: + # Microsoft.Extensions.*, EF Core, and AspNetCore ship as one + # versioned wave; splitting them produces PRs that fail to restore + # against each other. + microsoft: + patterns: + - "Microsoft.*" + - "System.Text.Json" + opentelemetry: + patterns: + - "OpenTelemetry.*" + testing: + patterns: + - "xunit*" + - "NSubstitute" + - "FluentAssertions" + - "Testcontainers*" + - "NetArchTest*" + - "coverlet*" + analyzers: + patterns: + - "Meziantou.Analyzer" + - "Microsoft.CodeAnalysis.*Analyzers" + + # ---- NuGet: dotnet new template content ---------------------------- + # templates/resq-service/ has its own Directory.Packages.props and is + # scaffolded/restored outside the root tree (see NuGet.config), so it + # needs its own entry — the root scan does not reach it. Kept separate + # so template bumps are reviewed on their own: they change what + # downstream services are scaffolded with. + - package-ecosystem: nuget + directory: /templates/resq-service + schedule: + interval: weekly + day: monday + time: "06:17" + open-pull-requests-limit: 3 + labels: + - chore + - deps + groups: + # The template references this repo's own published packages. They + # version together off one MinVer tag, so without grouping every + # release opens eight near-identical PRs against the template. + resq-buildingblocks: + patterns: + - "ResQ.BuildingBlocks.*" + template-deps: + patterns: + - "Microsoft.*" + - "OpenTelemetry.*" + - "xunit*" + - "Testcontainers*" + - "NetArchTest*" + - "coverlet*" + + # ---- GitHub Actions ------------------------------------------------- + # All 11 actions are SHA-pinned. Dependabot updates SHA pins in place + # and rewrites the trailing `# vX.Y.Z` comment, so pins stay pins. + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + day: monday + time: "06:17" + open-pull-requests-limit: 5 + labels: + - chore + - deps + groups: + github-actions: + patterns: + - "*" + ignore: + # Version-locked to the gh-aw compiler and rewritten by + # `gh aw compile` into the *.lock.yml files; a Dependabot bump here + # is reverted on the next compile. + - dependency-name: "github/gh-aw-actions*"