mirror of
https://github.com/chillpadclub/bedolaga-cabinet.git
synced 2026-07-28 09:33:46 +00:00
aa1ecbfdef
- .github/dependabot.yml: еженедельные обновления npm/github-actions/docker со сгруппированными PR - codeql.yml: SAST (javascript-typescript, security-and-quality) на push/PR в main/dev + еженедельный проход - security-audit.yml: npm audit --audit-level=high (пока non-blocking) - docker.yml: Trivy-скан запушенного образа с выгрузкой SARIF в Security tab (non-blocking), least-privilege permissions на workflow
36 lines
839 B
YAML
36 lines
839 B
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: "npm"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 10
|
|
groups:
|
|
# Схлопываем шумные обновления в один PR, чтобы не плодить десятки веток.
|
|
dev-dependencies:
|
|
dependency-type: "development"
|
|
production-minor-patch:
|
|
dependency-type: "production"
|
|
update-types:
|
|
- "minor"
|
|
- "patch"
|
|
labels:
|
|
- "dependencies"
|
|
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 5
|
|
labels:
|
|
- "dependencies"
|
|
- "ci"
|
|
|
|
- package-ecosystem: "docker"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
labels:
|
|
- "dependencies"
|
|
- "docker"
|