Keli GrubbandMadison Grubb
6e7190e985
## Summary * turn on `osvVulnerabilityAlerts` + `vulnerabilityAlerts` so vulnerable deps get their own PRs labeled `security`, instead of just riding along in the grouped non-major PR * vuln PRs still respect the 3 day `minimumReleaseAge` cooldown on purpose. bypassing it would let a compromised release (shai-hulud style) land the moment it publishes, which is worse than sitting on a known cve for 3 days * add `abandonments:recommended` so unmaintained packages get flagged early * add `dependencies` label plus `prConcurrentLimit` / `prHourlyLimit` of 5 so a first run on a stale repo doesn't dump 30 prs * no workflow behavior changes. schedule stays hourly, install stays as-is. just fixed the readme, which said every 6 hours while the cron was hourly needs `dependencies` and `security` labels to exist on the repos (or org-wide), otherwise labeling just no-ops. --------- Co-authored-by: Madison Grubb <madison@elastiflow.com> Reviewed-on: #8
33 lines
948 B
JSON
33 lines
948 B
JSON
{
|
|
"extends": [
|
|
"config:recommended",
|
|
":configMigration",
|
|
"group:allNonMajor",
|
|
":disableDependencyDashboard",
|
|
"abandonments:recommended"
|
|
],
|
|
"gitAuthor": "Renovate Bot <renovate@keligrubb.com>",
|
|
"semanticCommits": "enabled",
|
|
"semanticCommitType": "chore",
|
|
"semanticCommitScope": "deps",
|
|
"prBodyTemplate": "{{{header}}}{{{table}}}{{{warnings}}}{{{notes}}}{{{changelogs}}}{{{controls}}}",
|
|
"minimumReleaseAge": "3 days",
|
|
"rangeStrategy": "auto",
|
|
"labels": ["dependencies"],
|
|
"osvVulnerabilityAlerts": true,
|
|
"vulnerabilityAlerts": {
|
|
"enabled": true,
|
|
"labels": ["security", "dependencies"]
|
|
},
|
|
"prConcurrentLimit": 5,
|
|
"prHourlyLimit": 5,
|
|
"dockerfile": {
|
|
"digest": { "enabled": false }
|
|
},
|
|
"packageRules": [
|
|
{ "matchDatasources": ["docker"], "pinDigests": false },
|
|
{ "matchManagers": ["dockerfile"], "pinDigests": false },
|
|
{ "matchUpdateTypes": ["pin"], "enabled": false }
|
|
]
|
|
}
|