Xlorep DarkHelm
f627ef018a
Some checks failed
CICD / Build and Publish CICD Base Image (push) Successful in 36s
CICD / Build and Push CICD Image (push) Has been cancelled
CICD / Build CICD Image Failure Postmortem (push) Has been cancelled
CICD / Backend Tests (push) Has been cancelled
CICD / Pre-commit Checks (push) Has been cancelled
CICD / Frontend Tests (push) Has been cancelled
CICD / Backend Doctests (push) Has been cancelled
CICD / Frontend Dependency Audit (push) Has been cancelled
CICD / Backend Dependency Audit (push) Has been cancelled
CICD / CICD Tests Complete (push) Has been cancelled
CICD / Build Backend Base Image (push) Has been cancelled
CICD / Build Frontend Base Image (push) Has been cancelled
CICD / Build Integration Tester Image (push) Has been cancelled
CICD / Build E2E Tester Image (push) Has been cancelled
CICD / Build Frontend Main Image (push) Has been cancelled
CICD / Production Images Complete (push) Has been cancelled
CICD / End-to-End Tests (push) Has been cancelled
CICD / E2E Tests Failure Postmortem (push) Has been cancelled
CICD / Build Backend Main Image (push) Has been cancelled
CICD / Production Image Failures Postmortem (push) Has been cancelled
CICD / Source Lanes Failure Postmortem (push) Has been cancelled
CICD / Runtime Black-Box Integration Tests (push) Has been cancelled
CICD / Integration Tests Failure Postmortem (push) Has been cancelled
## Summary This PR integrates security-focused checks into the existing quality gates and aligns local workflows with CI/CD execution. ## What changed - Added Bandit to pre-commit backend checks. - Integrated eslint-plugin-security into the existing frontend ESLint setup used by pre-commit. - Added dedicated audit tasks: - backend audit via pip-audit - frontend audit via yarn npm audit - Updated CI/CD workflow to include and gate on frontend/backend audit jobs. - Switched backend vulnerability scanning from Safety to pip-audit to avoid interactive/auth requirements in CI. - Updated backend dependency set and lockfile to resolve test dependency conflicts and keep the environment solvable. - Marked backend integration API tests with the integration marker so marker-based unit/integration separation works consistently. ## Validation - Pre-commit hooks run and pass after formatting/autofixes. - Branch commit created successfully after hook-driven file updates. - Branch pushed to remote and tracking is configured. ## Notes - pip-audit now executes from backend context (for example via uv --directory backend run ...), matching project layout. - Remaining reported vulnerabilities depend on upstream package fix availability/constraints and may require follow-up once publishable fix versions are consumable. ## Follow-ups (optional) - Add a curated pip-audit ignore policy for non-actionable/transient advisories with rationale. - Open a focused follow-up PR for remaining dependency advisories once upstream fixes are practically installable. Co-authored-by: copilotcoder <copilotcoder@darkhelm.org> Reviewed-on: #74
139 lines
5.2 KiB
JSON
139 lines
5.2 KiB
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": [
|
|
"config:recommended",
|
|
":dependencyDashboard",
|
|
":semanticCommits",
|
|
":separatePatchReleases"
|
|
],
|
|
"timezone": "America/New_York",
|
|
"schedule": ["before 9am every weekday"],
|
|
"prConcurrentLimit": 5,
|
|
"branchConcurrentLimit": 10,
|
|
"prHourlyLimit": 2,
|
|
"enabledManagers": [
|
|
"docker-compose",
|
|
"dockerfile",
|
|
"github-actions",
|
|
"npm",
|
|
"pep621",
|
|
"regex"
|
|
],
|
|
"packageRules": [
|
|
{
|
|
"description": "Automerge non-major updates for high-confidence packages",
|
|
"matchUpdateTypes": ["minor", "patch", "pin", "digest"],
|
|
"matchPackagePatterns": [
|
|
"^@types/",
|
|
"^eslint",
|
|
"^prettier",
|
|
"^ruff",
|
|
"^pytest"
|
|
],
|
|
"automerge": true,
|
|
"automergeType": "branch"
|
|
},
|
|
{
|
|
"description": "Group Python dev tools updates",
|
|
"matchManagers": ["pep621"],
|
|
"matchCategories": ["python"],
|
|
"matchPackageNames": [
|
|
"ruff",
|
|
"pyright",
|
|
"pydoclint",
|
|
"pytest",
|
|
"pytest-asyncio",
|
|
"pytest-cov",
|
|
"pytest-mock",
|
|
"pre-commit",
|
|
"pyyaml",
|
|
"yamllint",
|
|
"toml-sort",
|
|
"language-formatters-pre-commit-hooks",
|
|
"xdoctest",
|
|
"poethepoet"
|
|
],
|
|
"groupName": "Python dev tools",
|
|
"schedule": ["before 9am on monday"]
|
|
},
|
|
{
|
|
"description": "Group Frontend dev tools updates",
|
|
"matchManagers": ["npm"],
|
|
"matchDepTypes": ["devDependencies"],
|
|
"matchPackagePatterns": [
|
|
"^@typescript-eslint/",
|
|
"^eslint",
|
|
"^prettier",
|
|
"^vite",
|
|
"^vitest",
|
|
"^playwright"
|
|
],
|
|
"groupName": "Frontend dev tools",
|
|
"schedule": ["before 9am on monday"]
|
|
},
|
|
{
|
|
"description": "Group Docker base image updates",
|
|
"matchManagers": ["dockerfile"],
|
|
"matchPackageNames": ["ubuntu", "node", "python"],
|
|
"groupName": "Docker base images",
|
|
"schedule": ["before 9am on monday"],
|
|
"automerge": false,
|
|
"reviewersFromCodeOwners": true
|
|
},
|
|
{
|
|
"description": "Security updates - high priority",
|
|
"matchPackagePatterns": [".*"],
|
|
"vulnerabilityAlerts": true,
|
|
"prPriority": 10,
|
|
"automerge": false,
|
|
"labels": ["security"],
|
|
"reviewersFromCodeOwners": true
|
|
},
|
|
{
|
|
"description": "Major updates - require manual review",
|
|
"matchUpdateTypes": ["major"],
|
|
"automerge": false,
|
|
"labels": ["major-update"],
|
|
"prPriority": 5,
|
|
"reviewersFromCodeOwners": true
|
|
},
|
|
{
|
|
"description": "Skip automatic updates for project Python runtime constraint",
|
|
"matchManagers": ["pep621"],
|
|
"matchPackageNames": ["python"],
|
|
"enabled": false
|
|
}
|
|
],
|
|
"customManagers": [
|
|
{
|
|
"description": "Update Python version in Dockerfiles",
|
|
"customType": "regex",
|
|
"fileMatch": ["^Dockerfile.*$"],
|
|
"matchStrings": ["FROM python:(?<currentValue>\\d+\\.\\d+)"],
|
|
"datasourceTemplate": "docker",
|
|
"depNameTemplate": "python",
|
|
"versioningTemplate": "loose"
|
|
},
|
|
{
|
|
"description": "Update Node.js version in Dockerfiles",
|
|
"customType": "regex",
|
|
"fileMatch": ["^Dockerfile.*$"],
|
|
"matchStrings": ["FROM node:(?<currentValue>\\d+)"],
|
|
"datasourceTemplate": "docker",
|
|
"depNameTemplate": "node",
|
|
"versioningTemplate": "node"
|
|
}
|
|
],
|
|
"osvVulnerabilityAlerts": false,
|
|
"vulnerabilityAlerts": {
|
|
"enabled": true,
|
|
"schedule": ["at any time"]
|
|
},
|
|
"labels": ["dependencies"],
|
|
"commitMessagePrefix": "chore:",
|
|
"commitMessageTopic": "{{depName}}",
|
|
"commitMessageExtra": "to {{newVersion}}",
|
|
"commitMessageSuffix": "",
|
|
"prBodyTemplate": "This PR contains the following updates:\n\n| Package | Change | Age | Adoption | Passing | Confidence |\n|---|---|---|---|---|---|\n{{#each upgrades}}\n|{{depName}}|{{#if displayFrom}}`{{{displayFrom}}}` -> `{{{displayTo}}}`{{else}}`{{{newVersion}}}`{{/if}}|[](https://docs.renovatebot.com/merge-confidence/)|[](https://docs.renovatebot.com/merge-confidence/)|[](https://docs.renovatebot.com/merge-confidence/)|[](https://docs.renovatebot.com/merge-confidence/)|\n{{/each}}\n\n---\n\n### Release Notes\n\n{{#each upgrades}}\n{{#if hasReleaseNotes}}\n<details>\n<summary>{{depName}}</summary>\n\n{{#each releases}}\n#### {{title}}\n\n{{#if body}}\n{{body}}\n{{/if}}\n{{/each}}\n\n</details>\n{{/if}}\n{{/each}}\n\n### Configuration\n\n📅 **Schedule**: {{schedule}}\n\n🚦 **Automerge**: {{#if isAutomerge}}Enabled{{else}}Disabled{{/if}}\n\n♻ **Rebasing**: {{#if isRebasing}}Rebasing{{else}}Not rebasing{{/if}}\n\n👥 **Reviewers**: {{#if reviewers}}{{reviewers}}{{else}}None{{/if}}\n\n---\n\n*This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).*"
|
|
}
|