7dd9f47ca2Adds npm audit fix (root + every client) as the first sub-step of the release skill's bump step, before npm version, so a release is never gated on remembering to check separately. Never --force; anything audit fix can't resolve is left to the dependabot-alert pipeline (#2229) or a follow-up issue. Disables Dependabot npm version updates in dependabot.yml (a version-update PR carries no issue and no board card) and replaces them with a monthly scheduled sweep that runs npm outdated across the root install and every client, filing or updating one idempotent tracking issue instead of an auto-generated PR. Closes #2231 Part of #2229 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017N9ha27Qg6LHpBQP7G7zPY Signed-off-by: cliffhall <cliff@futurescale.com>
36 lines
1.5 KiB
YAML
36 lines
1.5 KiB
YAML
version: 2
|
|
|
|
# npm version updates are OFF (#2229): a Dependabot version-update PR carries no
|
|
# issue and no board card, which is the same "every PR references an issue"
|
|
# carve-out the security-update flow had. Routine npm bumps are handled instead
|
|
# by a monthly `npm outdated` sweep (`.github/workflows/dependency-refresh.yml`)
|
|
# that files ONE tracking issue per run, boarded and milestoned like any other
|
|
# work — so a maintainer picks the bump and opens a normal PR against `v2/main`.
|
|
#
|
|
# Security updates are unaffected by this file either way: they are enabled in
|
|
# repo settings, not here. #2229 additionally proposes consuming them as
|
|
# Dependabot ALERTS rather than PRs (tracked, not yet built) — until that lands,
|
|
# security-update PRs still open against `main` and still need retargeting by
|
|
# hand, same as before.
|
|
#
|
|
# github-actions version updates stay on Dependabot's own PR flow below — out of
|
|
# scope for #2229, which was about npm packages specifically.
|
|
#
|
|
# Two things to know about this file:
|
|
# 1. Dependabot reads it from the DEFAULT branch (`main`). Changes here are
|
|
# inert until the next milestone merge carries them there.
|
|
# 2. `target-branch` scopes VERSION updates only (npm updates are removed
|
|
# here, so this now only applies to the github-actions entry below).
|
|
|
|
updates:
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
target-branch: "v2/main"
|
|
schedule:
|
|
interval: "monthly"
|
|
labels:
|
|
- "v2"
|
|
groups:
|
|
github-actions:
|
|
patterns:
|
|
- "*"
|