chore(ci): add a Dependabot configuration for cargo and github-actions

Offen
  • Stimmt etwas nicht?
#91 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
1-2 Tage
Anfängerfreundlichkeit
55/100
Issue-Typ
Feature
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
github-actions, rust
Bereich
ci-cd, devops

Rechercherichtung

Start with ADR-0101, .github/actions/setup-rust/action.yml, deny.toml, and docs/src/architecture/cicd.md to understand the existing workflow and advisory note. Add .github/dependabot.yml for the root Cargo workspace and GitHub Actions, then update the CI/CD documentation with coverage and the rsa/openidconnect review reminder. Confirm Dependabot keeps action SHA pins and that its pull requests run through gate; the issue leaves merge ownership and major version policy to be decided.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

area:process prio:p1

Context

There is no .github/dependabot.yml and no Renovate configuration in this repository. ADR-0101 lists Dependabot among the workflows a new package inherits, but nothing here configures it.

Every dependency change in #87 was made by hand: lock bumps for rustls-webpki, ctutils, webpki-roots and openidconnect (4.0.1 to 4.1.0), and a testcontainers major upgrade (0.23 to 0.27, with testcontainers-modules 0.11 to 0.15). The 21 external action references are pinned by SHA with a version comment, and nothing keeps those current either.

deny.toml also carries a note to re-check its one advisory ignore (RUSTSEC-2023-0071, rsa) whenever rsa or openidconnect is updated. Today an update only happens when somebody notices.

Problem

  • Dependencies and action pins go stale until an advisory forces a change, and then the change is urgent and manual (as #87's was).
  • Nothing prompts the rsa / openidconnect re-check.

Proposal

A .github/dependabot.yml with two ecosystems:

  • cargo, directory / (the workspace has one Cargo.lock): weekly, with groups for families that move together (RustCrypto; testcontainers and its modules) so one bump is one pull request, and a cap on open pull requests. Decide separately about probes/*, which are standalone workspaces with their own locks and are invisible to the root cargo deny.
  • github-actions: the workflows directory and .github/actions/setup-rust. Dependabot keeps SHA pins and updates the version comment.

Decide who merges them and the policy for major versions. Each pull request runs the full pipeline, so a bump is tested by gate like any other change (the cost is a full contract matrix per pull request, so grouping and a pull-request cap matter). A comment in dependabot.yml (or the pull request template) should say that a bump touching rsa or openidconnect means re-reading the ignore in deny.toml.

Acceptance criteria

  • Dependabot opens a pull request for each ecosystem, and gate passes on them (or fails for a reason that is about the bump).
  • An actions bump keeps the full-SHA pin, so the statement in docs/src/architecture/cicd.md that every external action is pinned still holds.
  • The rsa / openidconnect re-check is written down where a reviewer of such a pull request will see it.
  • docs/src/architecture/cicd.md says Dependabot exists and what it covers (it currently records only SHA pinning).

References

#40, #87; deny.toml (the note above the ignore); ADR-0101, "Neutral" consequences; .github/actions/setup-rust/action.yml; docs/src/architecture/cicd.md, "Permissions and supply chain".

Vorherrschende Sprache
Rust
Sterne
0
Forks
0
Ø Merge
1 Std. 35 Min.
Gemergte PRs (30 T.)
67

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus aRustyDev/thrust

Alle Issues in aRustyDev/thrust

Ähnliche Issues

Weitere Issues zu Rust

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.