mirror of
https://github.com/agessaman/meshcore-bot.git
synced 2026-09-25 00:54:50 +00:00
agessaman
ad7df3438b
CONTRIBUTING covers dev setup, reproducing all six CI jobs locally, and the house rules a newcomer would otherwise trip over: append-only migrations, config changes needing config.ini.example updates, new docs pages needing an mkdocs nav entry, the ruff pin, and PRs targeting dev. SECURITY routes reports through GitHub private vulnerability reporting rather than an email address, with a 10-day acknowledgement and 30-day assessment window. Scope names what this codebase actually exposes, and explicitly puts the MeshCore protocol, RF-layer attacks, and running the viewer without a password out of scope. Issue forms collect the details every radio bug report needs — version, transport, hardware, install method — and the feature form asks up front whether a proposal spends mesh airtime. Blank issues stay enabled since Discussions is not turned on, so they are the only route for questions. Dependabot covers GitHub Actions weekly, where a stale or compromised action is a real supply-chain risk. pip and npm are grouped and monthly: runtime deps are >= ranges, so version updates are mostly floor bumps, and security fixes arrive through Dependabot alerts regardless.
45 lines
1.3 KiB
YAML
45 lines
1.3 KiB
YAML
version: 2
|
|
|
|
updates:
|
|
# GitHub Actions — the highest-value ecosystem here. Actions are pinned by major
|
|
# tag (actions/checkout@v4), so a compromised or abandoned action is a real
|
|
# supply-chain risk and these updates are few and easy to review.
|
|
- package-ecosystem: github-actions
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
groups:
|
|
actions:
|
|
patterns: ["*"]
|
|
commit-message:
|
|
prefix: "build(actions)"
|
|
|
|
# Python. Runtime dependencies are declared as `>=` ranges rather than pins, so
|
|
# these are mostly floor bumps — grouped and monthly to keep the noise down.
|
|
# Security fixes arrive separately via Dependabot alerts and are not affected
|
|
# by this cadence.
|
|
- package-ecosystem: pip
|
|
directory: "/"
|
|
schedule:
|
|
interval: monthly
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
python:
|
|
patterns: ["*"]
|
|
update-types: ["minor", "patch"]
|
|
commit-message:
|
|
prefix: "build(deps)"
|
|
|
|
# Frontend lint tooling only (eslint, htmlhint) — devDependencies, no shipped
|
|
# runtime code, so monthly and grouped is plenty.
|
|
- package-ecosystem: npm
|
|
directory: "/"
|
|
schedule:
|
|
interval: monthly
|
|
open-pull-requests-limit: 3
|
|
groups:
|
|
frontend-lint:
|
|
patterns: ["*"]
|
|
commit-message:
|
|
prefix: "build(npm)"
|