chore(ci): add a Dependabot configuration for cargo and github-actions

未關閉
  • 哪裡不對？
#91 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

還沒有人認領這個 Issue。

評估

難度
4/5
預估耗時
1-2 天
新手友好度
55/100
Issue 類型
功能
描述清晰度
描述清楚
活躍度
活躍
技術堆疊
github-actions, rust
領域
ci-cd, devops

研究方向

Start with ADR-0101, .github/actions/setup-rust/action.yml, deny.toml, and docs/src/architecture/cicd.md to understand the existing workflow and advisory note. Add .github/dependabot.yml for the root Cargo workspace and GitHub Actions, then update the CI/CD documentation with coverage and the rsa/openidconnect review reminder. Confirm Dependabot keeps action SHA pins and that its pull requests run through gate; the issue leaves merge ownership and major version policy to be decided.

由索引模型根據 Issue 內容生成。

描述

area:process prio:p1

Context

There is no .github/dependabot.yml and no Renovate configuration in this repository. ADR-0101 lists Dependabot among the workflows a new package inherits, but nothing here configures it.

Every dependency change in #87 was made by hand: lock bumps for rustls-webpki, ctutils, webpki-roots and openidconnect (4.0.1 to 4.1.0), and a testcontainers major upgrade (0.23 to 0.27, with testcontainers-modules 0.11 to 0.15). The 21 external action references are pinned by SHA with a version comment, and nothing keeps those current either.

deny.toml also carries a note to re-check its one advisory ignore (RUSTSEC-2023-0071, rsa) whenever rsa or openidconnect is updated. Today an update only happens when somebody notices.

Problem

  • Dependencies and action pins go stale until an advisory forces a change, and then the change is urgent and manual (as #87's was).
  • Nothing prompts the rsa / openidconnect re-check.

Proposal

A .github/dependabot.yml with two ecosystems:

  • cargo, directory / (the workspace has one Cargo.lock): weekly, with groups for families that move together (RustCrypto; testcontainers and its modules) so one bump is one pull request, and a cap on open pull requests. Decide separately about probes/*, which are standalone workspaces with their own locks and are invisible to the root cargo deny.
  • github-actions: the workflows directory and .github/actions/setup-rust. Dependabot keeps SHA pins and updates the version comment.

Decide who merges them and the policy for major versions. Each pull request runs the full pipeline, so a bump is tested by gate like any other change (the cost is a full contract matrix per pull request, so grouping and a pull-request cap matter). A comment in dependabot.yml (or the pull request template) should say that a bump touching rsa or openidconnect means re-reading the ignore in deny.toml.

Acceptance criteria

  • Dependabot opens a pull request for each ecosystem, and gate passes on them (or fails for a reason that is about the bump).
  • An actions bump keeps the full-SHA pin, so the statement in docs/src/architecture/cicd.md that every external action is pinned still holds.
  • The rsa / openidconnect re-check is written down where a reviewer of such a pull request will see it.
  • docs/src/architecture/cicd.md says Dependabot exists and what it covers (it currently records only SHA pinning).

References

#40, #87; deny.toml (the note above the ignore); ADR-0101, "Neutral" consequences; .github/actions/setup-rust/action.yml; docs/src/architecture/cicd.md, "Permissions and supply chain".

主要語言
Rust
星號
0
分支
0
平均合併
1 小時 35 分鐘
30 天內合併 PR
67

環境準備

  • 沒有 Dockerfile 或 Docker Compose 檔案
  • 沒有 Pull Request 範本
  • 閱讀貢獻指南

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

aRustyDev/thrust 的其他 Issue

查看 aRustyDev/thrust 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。