From 3a948c68ad6dfff90a8bb4e0947419b52c60381e Mon Sep 17 00:00:00 2001 From: Davy <95214375+thedavidweng@users.noreply.github.com> Date: Thu, 13 Aug 2026 03:03:20 -0700 Subject: [PATCH 1/3] ci: make Dependabot PRs merge-ready Pin audit-breaking transitive packages, keep CodeQL init/analyze in lockstep, pin release actions so zizmor stays green, and auto-merge patch/non-production minor upgrades. --- .github/dependabot.yml | 4 +++ .github/workflows/ci.yml | 2 +- .github/workflows/codeql.yml | 6 ++-- .github/workflows/dependabot-automerge.yml | 39 ++++++++++++++++++++++ .github/workflows/dependabot-fmt.yml | 2 +- .github/workflows/release.yml | 8 ++--- pnpm-lock.yaml | 20 ++++++----- pnpm-workspace.yaml | 4 +++ 8 files changed, 68 insertions(+), 17 deletions(-) create mode 100644 .github/workflows/dependabot-automerge.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 447b765..5ec6262 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -44,6 +44,10 @@ updates: interval: "weekly" day: "monday" open-pull-requests-limit: 5 + groups: + codeql-action: + patterns: + - "github/codeql-action*" labels: - "dependencies" - "ci" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ca646a2..3fbac5f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,7 +22,7 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup pnpm - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 + uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 - name: Setup Node uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b1322d8..265cfbb 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,16 +32,16 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Initialize CodeQL - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 + uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5 with: languages: ${{ matrix.language }} queries: security-extended - name: Autobuild - uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 + uses: github/codeql-action/autobuild@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5 if: matrix.build-mode == 'autobuild' - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 + uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml new file mode 100644 index 0000000..50bf2cb --- /dev/null +++ b/.github/workflows/dependabot-automerge.yml @@ -0,0 +1,39 @@ +name: Dependabot auto-merge + +on: + pull_request: + +permissions: + contents: write + pull-requests: write + +jobs: + automerge: + name: Enable auto-merge + if: github.actor == 'dependabot[bot]' + runs-on: ubuntu-latest + timeout-minutes: 5 + steps: + - name: Dependabot metadata + id: meta + uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0 + + - name: Enable auto-merge for safe updates + if: > + steps.meta.outputs.update-type == 'version-update:semver-patch' + || ( + steps.meta.outputs.update-type == 'version-update:semver-minor' + && steps.meta.outputs.dependency-type != 'direct:production' + ) + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + PR_URL: ${{ github.event.pull_request.html_url }} + run: | + deny='googleapis/release-please-action golangci/golangci-lint-action' + names="${{ steps.meta.outputs.dependency-names }}" + for blocked in $deny; do + case " $names " in + *" $blocked "*) echo "skip auto-merge: $blocked"; exit 0 ;; + esac + done + gh pr merge --auto --squash "$PR_URL" diff --git a/.github/workflows/dependabot-fmt.yml b/.github/workflows/dependabot-fmt.yml index 7bdd3ea..1acb437 100644 --- a/.github/workflows/dependabot-fmt.yml +++ b/.github/workflows/dependabot-fmt.yml @@ -22,7 +22,7 @@ jobs: token: ${{ secrets.GITHUB_TOKEN }} - name: Setup pnpm - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9 + uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 - name: Setup Node uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3c89318..98e1898 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -22,7 +22,7 @@ jobs: tag: ${{ steps.release.outputs.tag }} steps: - name: Checkout - uses: actions/checkout@v7.0.1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Resolve release tag id: release @@ -34,10 +34,10 @@ jobs: fi - name: Setup pnpm - uses: pnpm/action-setup@v6.0.9 + uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10 - name: Setup Node - uses: actions/setup-node@v7.0.0 + uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 cache: pnpm @@ -105,7 +105,7 @@ jobs: args: --target aarch64-apple-darwin - name: Upload DMG artifact - uses: actions/upload-artifact@v7.0.1 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: openloop-${{ steps.release.outputs.tag }}-macos-dmg path: | diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 0fe608f..552df7f 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -4,6 +4,10 @@ settings: autoInstallPeers: true excludeLinksFromLockfile: false +overrides: + undici@>=7 <7.29.0: 7.29.0 + nanoid@>=3 <3.3.17: 3.3.17 + importers: .: @@ -1588,8 +1592,8 @@ packages: resolution: {integrity: sha512-I9jwMn07Sy/IwOj3zVkVik2JTvgpaykDZEigL6Rx6N9LbMywwUSMtxET+7lVoDLLd3O3IXwJwvuuns8UB/HeAg==} engines: {node: '>=4'} - nanoid@3.3.16: - resolution: {integrity: sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==} + nanoid@3.3.17: + resolution: {integrity: sha512-xQLf0A3HOMlgHq0n247/LRuAOYmB7dXJ/DvAxGvsSBij45XtBSmQycu+F8ODbHwns/XyFZagyL1+J0Offw1E0g==} engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1} hasBin: true @@ -1810,8 +1814,8 @@ packages: resolution: {integrity: sha512-3cudTErfToSc4Ggv8XGXVNVli/xHKUtUZvaY5UVwhOcUPbQGz7PeaEnT/SAVgNziZtX67KEN9swMUYkLghxA1w==} engines: {node: '>=14'} - undici@7.28.0: - resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==} + undici@7.29.0: + resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} engines: {node: '>=20.18.1'} use-sync-external-store@1.6.0: @@ -2874,7 +2878,7 @@ snapshots: saxes: 6.0.0 symbol-tree: 3.2.4 tough-cookie: 6.0.1 - undici: 7.28.0 + undici: 7.29.0 w3c-xmlserializer: 5.0.0 webidl-conversions: 8.0.1 whatwg-mimetype: 5.0.0 @@ -3017,7 +3021,7 @@ snapshots: min-indent@1.0.1: {} - nanoid@3.3.16: {} + nanoid@3.3.17: {} obug@2.1.3: {} @@ -3136,7 +3140,7 @@ snapshots: postcss@8.5.22: dependencies: - nanoid: 3.3.16 + nanoid: 3.3.17 picocolors: 1.1.1 source-map-js: 1.2.1 @@ -3287,7 +3291,7 @@ snapshots: unbash@4.0.3: {} - undici@7.28.0: {} + undici@7.29.0: {} use-sync-external-store@1.6.0(react@19.2.8): dependencies: diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 391786e..de5f1f3 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -20,3 +20,7 @@ onlyBuiltDependencies: allowBuilds: esbuild: true lefthook: true + +overrides: + "undici@>=7 <7.29.0": "7.29.0" + "nanoid@>=3 <3.3.17": "3.3.17" From 5516aceb3d365c6d00a26d1cb8f40249e199f05b Mon Sep 17 00:00:00 2001 From: Davy <95214375+thedavidweng@users.noreply.github.com> Date: Thu, 13 Aug 2026 03:08:37 -0700 Subject: [PATCH 2/3] ci: satisfy zizmor on Dependabot auto-merge and release workflows --- .github/workflows/dependabot-automerge.yml | 18 +++++++++++++----- .github/workflows/release.yml | 1 - 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 50bf2cb..8daad1a 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -3,16 +3,24 @@ name: Dependabot auto-merge on: pull_request: -permissions: - contents: write - pull-requests: write +# Job-scoped write is enough to enable auto-merge on the Dependabot PR. +permissions: {} + +concurrency: + group: dependabot-automerge-${{ github.event.pull_request.number }} + cancel-in-progress: true jobs: automerge: name: Enable auto-merge - if: github.actor == 'dependabot[bot]' + if: > + github.event.pull_request.user.login == 'dependabot[bot]' + && github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest timeout-minutes: 5 + permissions: + contents: write # gh pr merge --auto + pull-requests: write # enable auto-merge on the PR steps: - name: Dependabot metadata id: meta @@ -29,7 +37,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} PR_URL: ${{ github.event.pull_request.html_url }} run: | - deny='googleapis/release-please-action golangci/golangci-lint-action' + deny='googleapis/release-please-action golangci/golangci-lint-action @earendil-works/pi-tui dependabot/fetch-metadata' names="${{ steps.meta.outputs.dependency-names }}" for blocked in $deny; do case " $names " in diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 98e1898..af7e1f2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -40,7 +40,6 @@ jobs: uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 - cache: pnpm - name: Setup Rust uses: dtolnay/rust-toolchain@stable From e49401bf3cc70f39377dcd4b3fdf58c40ddc4680 Mon Sep 17 00:00:00 2001 From: Davy <95214375+thedavidweng@users.noreply.github.com> Date: Thu, 13 Aug 2026 03:16:20 -0700 Subject: [PATCH 3/3] ci: disable setup-node package-manager cache on release --- .github/workflows/release.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index af7e1f2..f819312 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -40,6 +40,7 @@ jobs: uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 with: node-version: 24 + package-manager-cache: false - name: Setup Rust uses: dtolnay/rust-toolchain@stable