Rework dependency updates: Dependabot for CVEs, Renovate for everything else

未關閉
  • 哪裡不對？
#400 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

還沒有人認領這個 Issue。

評估

難度
4/5
預估耗時
3-5 天
新手友好度
49/100
Issue 類型
功能
描述清晰度
描述清楚
活躍度
活躍
技術堆疊
github-actions, python, yaml
領域
build-system, ci-cd, devops

研究方向

Start with the listed files: template/pyproject.toml.jinja, pyproject.toml, renovate.json, template/renovate.json.jinja, periodic.yml, and the two dependency docs. Check the open questions about Renovate version and permissions, then trace how periodic.yml is rendered and how its test matrix runs. Done means the cooldown, Renovate settings, weekly unlocked job, failure issue handling, and docs match the proposal.

由索引模型根據 Issue 內容生成。

描述

Rework dependency updates: Renovate only, no automerge, 3-day cooldown, weekly unlocked tests

Problem

  • We use an uncomfortable mix of Renovate and Dependabot, with no clear split of responsibilities.
  • Renovate's lockFileMaintenance automerges, which people dislike, and it fills git history with lockfile commits.
  • Nothing tells us when an upstream release will break downstream users who install unlocked.
  • There's no cooldown on new releases, which leaves us exposed to supply-chain attacks via freshly published packages.
  • Until recently, Renovate only fixed CVEs in direct dependencies, so CVEs in transitive dependencies in uv.lock sat unfixed (see python-zocalo#319 for an example of the manual catch-up).

Goals

  1. CI runs against the lockfile, so upstream releases don't break unrelated PRs.
  2. A periodic unlocked run tells us what upstream changes would break downstream users.
  3. Nothing resolves releases newer than 3 days: not lock refreshes, not local upgrades, not unlocked runs.
  4. CVEs are patched as soon as the fix release is 3 days old, including in transitive dependencies. Urgent fixes can bypass the cooldown per package.

Proposal

Area Current Proposed
CI Runs locked (uv run --locked) Unchanged
Release cooldown None exclude-newer = "3 days" in pyproject.toml, matched by Renovate minimumReleaseAge: "3 days". Applies to every resolution: lock refreshes, local uv lock --upgrade, and the unlocked job
CVE alerts Dependabot alerts (enabled in settings) Unchanged. Used only as the alert source; no Dependabot PRs, no settings changes
CVE fixes Renovate vulnerabilityAlerts (via config:recommended), direct dependencies only Unchanged config, and now covers transitive deps in uv.lock (Renovate ≥ 44.221.0, renovatebot/renovate#47482). Security PRs open immediately, ignoring schedule and grouping. If the fix is under 3 days old, the PR fails to lock until the window passes; for urgent cases, add exclude-newer-package to bypass
Lockfile refresh Renovate lockFileMaintenance, automerged On demand only: a Dependency Dashboard checkbox, never automerged. Obeys the cooldown via pyproject.toml
Upstream breakage Nothing Weekly unlocked test job in periodic.yml; opens/updates an issue on failure
Actions / pre-commit bumps Renovate, minor/patch grouped Renovate, all grouped into a weekly PR, no automerge
Template-managed deps downstream Ignored in template/renovate.json.jinja Unchanged
Copier updates Renovate copier manager Unchanged
Automerge On for lock maintenance, via the renovate-approve app Off everywhere; renovate-approve no longer needed

Renovate is the only bot. Dependabot is used only as the source of alerts on GitHub. On internal GitLab, Renovate's osvVulnerabilityAlerts plays the same role, and also covers uv transitive deps. So the setup is consistent across both.

Renovate doesn't apply minimumReleaseAge to lockFileMaintenance; it just runs uv lock --upgrade. That's why the cooldown has to live in pyproject.toml rather than only in Renovate config.

Implementation (outline)

  • template/pyproject.toml.jinja (and the template's own pyproject.toml): add exclude-newer = "3 days" under [tool.uv].
  • renovate.json / template/renovate.json.jinja:
    • set automerge: false
    • add a weekly schedule
    • set minimumReleaseAge: "3 days"
    • set lockFileMaintenance.dependencyDashboardApproval: true
    • group actions/pre-commit updates
    • keep the existing template-managed ignores and the default vulnerabilityAlerts
  • periodic.yml:
    • add a weekly job that runs tests with --upgrade instead of --locked, across the supported Python matrix (the cooldown comes from pyproject.toml)
    • open or update a single issue on failure
    • render periodic.yml unconditionally, since it's currently gated on sphinx, and make the linkcheck job conditional instead
  • Docs:
    • rewrite renovate.md to remove automerge and the renovate-approve app, and to describe the dashboard lock refresh and security PRs
    • document the cooldown in lock-requirements.md, including how to bypass it for an urgent fix with exclude-newer-package = { <pkg> = false }, to be removed after merge

Open questions

  • Is the Mend-hosted Renovate app on ≥ 44.221.0, and does it have read access to Dependabot alerts? Both are needed for transitive CVE fixes.
  • Verify on a test repo that Renovate opens a fix PR for a transitive-only vulnerable package in uv.lock, and that a fix under 3 days old succeeds on a later run once the window passes. The transitive feature only landed on 2026-11-05.
  • Should the weekly periodic job also run pip-audit against the locked environment, as a safety net while the transitive support beds in?
  • Does dependencyDashboardApproval behave as expected for lockFileMaintenance on our Renovate version?
  • Should repos that build and deploy images from the lock keep a scheduled (e.g. monthly) lock refresh in their own Renovate config?
  • Align the cooldown window with python-zocalo, which uses the same pattern with 7 days.
主要語言
Jinja
星號
25
分支
10
平均合併
1 天 8 小時
30 天內合併 PR
4

環境準備

在 Codespaces 中開啟

在瀏覽器裡用你自己的 GitHub 帳號啟動這個專案的開發容器。

  • 提供 Dockerfile 或 Docker Compose 檔案
  • 沒有 Pull Request 範本
  • 閱讀貢獻指南

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

DiamondLightSource/python-copier-template 的其他 Issue

查看 DiamondLightSource/python-copier-template 的全部 Issue

相似的 Issue

更多 Build System Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。