kingchenc
49c0fd7dd5
Clears the remaining zizmor code-scanning findings on this repo. **Fixed** - `dependabot-cooldown` (5): a 7-day cooldown on every update ecosystem (cargo, npm, pip, ci-pip, github-actions) so Dependabot waits a week after a release before opening the bump PR. **Accepted via `.github/zizmor.yml`** (no workflow code changed) - `template-injection` (sync-about.yml): false positive — every expansion is the internal `grep -c` indicator count, not attacker-controllable. - `use-trusted-publishing` (release.yml): OIDC migration tracked separately. - `superfluous-actions` (release.yml): `softprops/action-gh-release` kept deliberately. Verified with zizmor 1.25.2: 0 findings.
62 lines
1.7 KiB
YAML
62 lines
1.7 KiB
YAML
version: 2
|
|
updates:
|
|
# Rust workspace (root Cargo.toml + all member crates).
|
|
- package-ecosystem: cargo
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
open-pull-requests-limit: 10
|
|
cooldown:
|
|
default-days: 7
|
|
commit-message:
|
|
prefix: "deps(cargo)"
|
|
|
|
# Node binding npm dependencies.
|
|
- package-ecosystem: npm
|
|
directory: "/bindings/node"
|
|
schedule:
|
|
interval: weekly
|
|
open-pull-requests-limit: 10
|
|
cooldown:
|
|
default-days: 7
|
|
commit-message:
|
|
prefix: "deps(npm)"
|
|
|
|
# Python binding pip dependencies.
|
|
- package-ecosystem: pip
|
|
directory: "/bindings/python"
|
|
schedule:
|
|
interval: weekly
|
|
open-pull-requests-limit: 10
|
|
cooldown:
|
|
default-days: 7
|
|
commit-message:
|
|
prefix: "deps(pip)"
|
|
|
|
# Hash-pinned CI/bench Python tooling under .github/requirements/. Each
|
|
# <name>.in is the loose source; the matching hash-locked <name>.txt is the
|
|
# output regenerated by scripts/update-lockfiles.sh (uv). Dependabot keeps the
|
|
# pins fresh; ci-dev-py39.in caps numpy <2.1 so 3.9 stays installable. Any
|
|
# bump that breaks a matrix row surfaces in the PR's CI run.
|
|
- package-ecosystem: pip
|
|
directory: "/.github/requirements"
|
|
schedule:
|
|
interval: weekly
|
|
open-pull-requests-limit: 10
|
|
cooldown:
|
|
default-days: 7
|
|
commit-message:
|
|
prefix: "deps(ci-pip)"
|
|
|
|
# GitHub Actions — keeps the SHA-pinned actions current (Dependabot reads
|
|
# the version comment after each pinned SHA and bumps both together).
|
|
- package-ecosystem: github-actions
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
open-pull-requests-limit: 10
|
|
cooldown:
|
|
default-days: 7
|
|
commit-message:
|
|
prefix: "deps(actions)"
|