chore(ci): add a Dependabot configuration for cargo and github-actions

Ouverte
  • Quelque chose ne va pas ?
#91 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
1-2 jours
Accessibilité débutants
55/100
Type d'issue
Fonctionnalité
Clarté
Clairement spécifiée
Activité
Active
Stack technique
github-actions, rust
Domaine
ci-cd, devops

Piste de recherche

Start with ADR-0101, .github/actions/setup-rust/action.yml, deny.toml, and docs/src/architecture/cicd.md to understand the existing workflow and advisory note. Add .github/dependabot.yml for the root Cargo workspace and GitHub Actions, then update the CI/CD documentation with coverage and the rsa/openidconnect review reminder. Confirm Dependabot keeps action SHA pins and that its pull requests run through gate; the issue leaves merge ownership and major version policy to be decided.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

area:process prio:p1

Context

There is no .github/dependabot.yml and no Renovate configuration in this repository. ADR-0101 lists Dependabot among the workflows a new package inherits, but nothing here configures it.

Every dependency change in #87 was made by hand: lock bumps for rustls-webpki, ctutils, webpki-roots and openidconnect (4.0.1 to 4.1.0), and a testcontainers major upgrade (0.23 to 0.27, with testcontainers-modules 0.11 to 0.15). The 21 external action references are pinned by SHA with a version comment, and nothing keeps those current either.

deny.toml also carries a note to re-check its one advisory ignore (RUSTSEC-2023-0071, rsa) whenever rsa or openidconnect is updated. Today an update only happens when somebody notices.

Problem

  • Dependencies and action pins go stale until an advisory forces a change, and then the change is urgent and manual (as #87's was).
  • Nothing prompts the rsa / openidconnect re-check.

Proposal

A .github/dependabot.yml with two ecosystems:

  • cargo, directory / (the workspace has one Cargo.lock): weekly, with groups for families that move together (RustCrypto; testcontainers and its modules) so one bump is one pull request, and a cap on open pull requests. Decide separately about probes/*, which are standalone workspaces with their own locks and are invisible to the root cargo deny.
  • github-actions: the workflows directory and .github/actions/setup-rust. Dependabot keeps SHA pins and updates the version comment.

Decide who merges them and the policy for major versions. Each pull request runs the full pipeline, so a bump is tested by gate like any other change (the cost is a full contract matrix per pull request, so grouping and a pull-request cap matter). A comment in dependabot.yml (or the pull request template) should say that a bump touching rsa or openidconnect means re-reading the ignore in deny.toml.

Acceptance criteria

  • Dependabot opens a pull request for each ecosystem, and gate passes on them (or fails for a reason that is about the bump).
  • An actions bump keeps the full-SHA pin, so the statement in docs/src/architecture/cicd.md that every external action is pinned still holds.
  • The rsa / openidconnect re-check is written down where a reviewer of such a pull request will see it.
  • docs/src/architecture/cicd.md says Dependabot exists and what it covers (it currently records only SHA pinning).

References

#40, #87; deny.toml (the note above the ignore); ADR-0101, "Neutral" consequences; .github/actions/setup-rust/action.yml; docs/src/architecture/cicd.md, "Permissions and supply chain".

Langage dominant
Rust
Étoiles
0
Forks
0
Merge moyen
1 h 35 min
PR mergées (30 j)
67

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de aRustyDev/thrust

Toutes les issues de aRustyDev/thrust

Issues similaires

Plus d'issues Rust

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.