chore(ci): add a Dependabot configuration for cargo and github-actions

Aberta
  • Algo errado?
#91 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
4/5
Tempo estimado
1-2 dias
Facilidade para iniciantes
55/100
Tipo de issue
Funcionalidade
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
github-actions, rust
Domínio
ci-cd, devops

Direção de pesquisa

Start with ADR-0101, .github/actions/setup-rust/action.yml, deny.toml, and docs/src/architecture/cicd.md to understand the existing workflow and advisory note. Add .github/dependabot.yml for the root Cargo workspace and GitHub Actions, then update the CI/CD documentation with coverage and the rsa/openidconnect review reminder. Confirm Dependabot keeps action SHA pins and that its pull requests run through gate; the issue leaves merge ownership and major version policy to be decided.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

area:process prio:p1

Context

There is no .github/dependabot.yml and no Renovate configuration in this repository. ADR-0101 lists Dependabot among the workflows a new package inherits, but nothing here configures it.

Every dependency change in #87 was made by hand: lock bumps for rustls-webpki, ctutils, webpki-roots and openidconnect (4.0.1 to 4.1.0), and a testcontainers major upgrade (0.23 to 0.27, with testcontainers-modules 0.11 to 0.15). The 21 external action references are pinned by SHA with a version comment, and nothing keeps those current either.

deny.toml also carries a note to re-check its one advisory ignore (RUSTSEC-2023-0071, rsa) whenever rsa or openidconnect is updated. Today an update only happens when somebody notices.

Problem

  • Dependencies and action pins go stale until an advisory forces a change, and then the change is urgent and manual (as #87's was).
  • Nothing prompts the rsa / openidconnect re-check.

Proposal

A .github/dependabot.yml with two ecosystems:

  • cargo, directory / (the workspace has one Cargo.lock): weekly, with groups for families that move together (RustCrypto; testcontainers and its modules) so one bump is one pull request, and a cap on open pull requests. Decide separately about probes/*, which are standalone workspaces with their own locks and are invisible to the root cargo deny.
  • github-actions: the workflows directory and .github/actions/setup-rust. Dependabot keeps SHA pins and updates the version comment.

Decide who merges them and the policy for major versions. Each pull request runs the full pipeline, so a bump is tested by gate like any other change (the cost is a full contract matrix per pull request, so grouping and a pull-request cap matter). A comment in dependabot.yml (or the pull request template) should say that a bump touching rsa or openidconnect means re-reading the ignore in deny.toml.

Acceptance criteria

  • Dependabot opens a pull request for each ecosystem, and gate passes on them (or fails for a reason that is about the bump).
  • An actions bump keeps the full-SHA pin, so the statement in docs/src/architecture/cicd.md that every external action is pinned still holds.
  • The rsa / openidconnect re-check is written down where a reviewer of such a pull request will see it.
  • docs/src/architecture/cicd.md says Dependabot exists and what it covers (it currently records only SHA pinning).

References

#40, #87; deny.toml (the note above the ignore); ADR-0101, "Neutral" consequences; .github/actions/setup-rust/action.yml; docs/src/architecture/cicd.md, "Permissions and supply chain".

Linguagem predominante
Rust
Estrelas
0
Forks
0
Merge médio
1h 35min
PRs com merge (30d)
67

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de aRustyDev/thrust

Todas as issues de aRustyDev/thrust

Issues semelhantes

Mais issues de Rust

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.