From 02d56458d1fc28806274ee164b19afd99e0cfc8b Mon Sep 17 00:00:00 2001 From: Isaac Insoll Date: Mon, 3 Aug 2026 14:31:54 +1000 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20cover=20coordinated=20dependency?= =?UTF-8?q?=20axes?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Keep Playwright and Vite updates synchronized with their external test artifacts, and cover the independent packed-consumer lockfile with Dependabot security updates and scheduled auditing. Align GitHub Actions major cooldowns after the first grouped Dependabot review. --- .github/dependabot.yml | 33 +++++++++++++++++++++++++++++++++ .github/workflows/security.yml | 2 +- CONTRIBUTING.md | 7 +++++++ docs/RELEASING.md | 3 +++ package.json | 4 +++- 5 files changed, 47 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 6483a11..b2e4f31 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -43,18 +43,51 @@ updates: - 'version-update:semver-major' - 'version-update:semver-minor' - 'version-update:semver-patch' + - dependency-name: 'vite' + update-types: + - 'version-update:semver-major' + - 'version-update:semver-minor' + - 'version-update:semver-patch' + - dependency-name: '@playwright/test' + update-types: + - 'version-update:semver-major' + - 'version-update:semver-minor' + - 'version-update:semver-patch' - dependency-name: '@types/node' update-types: - 'version-update:semver-major' commit-message: prefix: '⬆️' + # This independent install fixture has its own lockfile. Routine changes must + # stay synchronized with root/test-axis versions, but security updates remain + # eligible because update-types applies only to version updates. + - package-ecosystem: 'npm' + directory: '/test/fixtures/packed-consumer' + versioning-strategy: increase + schedule: + interval: 'monthly' + cooldown: + default-days: 7 + semver-major-days: 30 + semver-minor-days: 7 + ignore: + - dependency-name: '*' + update-types: + - 'version-update:semver-major' + - 'version-update:semver-minor' + - 'version-update:semver-patch' + commit-message: + prefix: '⬆️' + - package-ecosystem: 'github-actions' directory: '/' schedule: interval: 'monthly' cooldown: default-days: 7 + semver-major-days: 30 + semver-minor-days: 7 groups: github-actions: applies-to: version-updates diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 8d80ba6..2e4c671 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -52,5 +52,5 @@ jobs: corepack install npm --version - - name: Audit locked dependencies + - name: Audit root and packed-consumer dependencies run: npm run security:audit diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 5867719..2b2429f 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -41,6 +41,13 @@ replacing the React 18 or TypeScript 5.5 minimum-version fixtures, and regenerat both lockfiles together. Keep root `@types/node` on the Node 22 support floor; routine updates within that major remain automated. +Vite must match between the root and packed-consumer fixture. Playwright Test +must match the digest-pinned container and its browser binaries. Update either +set manually and review any affected browser snapshots. The packed-consumer +lockfile has separate Dependabot security coverage and is included in +`npm run security:audit`, but its routine updates remain part of this coordinated +process. + ## Checks Run the checks relevant to your change. Before requesting review, the complete diff --git a/docs/RELEASING.md b/docs/RELEASING.md index a06e129..2818aec 100644 --- a/docs/RELEASING.md +++ b/docs/RELEASING.md @@ -20,6 +20,9 @@ another release. passes. - The release workflow must use the repository's verified Corepack bootstrap and integrity-pinned npm version. +- Trusted publishing must use OIDC without `NODE_AUTH_TOKEN`. Bootstrap or + emergency token publishing must set `NODE_AUTH_TOKEN` explicitly only on the + publish step; `actions/setup-node` v7 no longer supplies a dummy value. - Workflow actions must use full commit SHAs and least-privilege permissions. - Only the publishing job may receive `id-token: write`; release operations may receive `contents: write` only when required. diff --git a/package.json b/package.json index 48cefcb..992ea6b 100644 --- a/package.json +++ b/package.json @@ -28,7 +28,9 @@ "watch": "tsdown --watch", "build": "tsdown", "package:check": "npm run build && node scripts/check-package.mjs", - "security:audit": "npm audit --audit-level=high", + "security:audit": "npm run security:audit:root && npm run security:audit:consumer", + "security:audit:root": "npm audit --audit-level=high", + "security:audit:consumer": "npm audit --prefix test/fixtures/packed-consumer --audit-level=high", "format": "prettier . --write", "format:check": "prettier . --check", "lint": "eslint . --max-warnings 0",