mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-09-04 04:01:07 +00:00
Mohd Kaif
fa87a1a9be
* ci: add npm Dependabot ecosystem and container image scanning - dependabot.yml had no npm ecosystem entry for explorer/, so its lockfile was never watched - exactly why the brace-expansion/nanoid CVEs fixed in #1280 went undetected. Add it, mirroring the existing pip entry's schedule/labels/reviewer conventions. - New container-scan.yml builds the root Dockerfile's image and scans it with Trivy (CRITICAL/HIGH OS+lib CVEs, SARIF to the Security tab) and Syft (SPDX SBOM artifact), on push to main, weekly, and manual dispatch. Neither the base-image scan nor an SBOM existed before - Dependabot's docker entry only bumps the base image tag, it doesn't scan built layers. - Trivy runs report-only for now (no exit-code gate): this is its first run against the image, so the CRITICAL/HIGH baseline hasn't been triaged yet. Once reviewed, add exit-code: '1' to make it a hard gate, same as Safety/Bandit-HIGH in security-scan.yml. * fix: run Trivy via digest-pinned image, not the aquasecurity/trivy-action wrapper verify-action-pins.sh failed in CI: the aquasecurity GitHub org has an IP allow list on its API that 403s the live tag->SHA resolution from Actions-runner IPs (confirmed reproducible, not transient - resolves fine from a non-blocked host). Rather than carve a skip exception into the pin verifier for an org this script already flags as a past tag-repointing target (see its "LiteLLM/Trivy 2026 incident" comment), pull Trivy as a sha256-digest-pinned Docker Hub image instead. A digest is immutable and verifiable independently of GitHub's API entirely, so it sidesteps the IP block without weakening verification of the one action this repo already treats as higher-risk. Confirmed the pinned digest (aquasec/trivy@sha256:62b1e65e...) resolves live against Docker Hub's registry API. * fix: match container-scan.yml's push paths to what actually reaches the image The path filter only watched explorer/package.json and package-lock.json, but Dockerfile COPYs the whole explorer/ tree plus README.md, LICENSE, and MANIFEST.in, and .dockerignore controls all of it. A frontend source change or a README/LICENSE edit would change the built image without triggering a scan, silently drifting until the next weekly run. Replace the filter with exactly .dockerignore's opt-in list.
161 lines
3.7 KiB
YAML
161 lines
3.7 KiB
YAML
version: 2
|
|
|
|
updates:
|
|
# Core Python dependencies
|
|
- package-ecosystem: "pip"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly" # Weekly for security
|
|
day: "monday"
|
|
time: "03:30" # 3:30 AM UTC (9:00 AM IST)
|
|
open-pull-requests-limit: 10 # Higher limit for security updates
|
|
reviewers:
|
|
- "KaifAhmad1"
|
|
assignees:
|
|
- "KaifAhmad1"
|
|
commit-message:
|
|
prefix: "security"
|
|
include: "scope"
|
|
labels:
|
|
- "dependencies"
|
|
- "python"
|
|
- "security"
|
|
allow:
|
|
- dependency-type: "production"
|
|
- dependency-type: "development"
|
|
ignore:
|
|
# Only ignore major version updates for stability-critical packages
|
|
- dependency-name: "torch"
|
|
update-types: ["version-update:semver-major"]
|
|
- dependency-name: "transformers"
|
|
update-types: ["version-update:semver-major"]
|
|
# Group new feature dependencies
|
|
groups:
|
|
security-critical:
|
|
patterns:
|
|
- "cryptography"
|
|
- "requests"
|
|
- "urllib3"
|
|
- "certifi"
|
|
- "pyopenssl"
|
|
dependency-type: "production"
|
|
snowflake-features:
|
|
patterns:
|
|
- "snowflake-connector-python"
|
|
- "cryptography"
|
|
arrow-features:
|
|
patterns:
|
|
- "pyarrow"
|
|
benchmark-tools:
|
|
patterns:
|
|
- "pytest-benchmark"
|
|
- "pytest-cov"
|
|
|
|
# GitHub Actions
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
time: "09:00"
|
|
open-pull-requests-limit: 3
|
|
reviewers:
|
|
- "KaifAhmad1"
|
|
assignees:
|
|
- "KaifAhmad1"
|
|
commit-message:
|
|
prefix: "ci"
|
|
include: "scope"
|
|
labels:
|
|
- "dependencies"
|
|
- "github-actions"
|
|
- "ci"
|
|
# All our actions are SHA-pinned with a "# vX" comment; Dependabot
|
|
# resolves the new tag's SHA and updates both the pin and the comment
|
|
# together, so this stays the source of truth (no separate script needed).
|
|
groups:
|
|
github-actions:
|
|
patterns:
|
|
- "*"
|
|
|
|
# Optional dependencies (separate schedule for stability)
|
|
- package-ecosystem: "pip"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "friday"
|
|
time: "09:00"
|
|
target-branch: "main"
|
|
open-pull-requests-limit: 3
|
|
reviewers:
|
|
- "KaifAhmad1"
|
|
assignees:
|
|
- "KaifAhmad1"
|
|
commit-message:
|
|
prefix: "deps"
|
|
include: "scope"
|
|
labels:
|
|
- "dependencies"
|
|
- "python"
|
|
- "optional"
|
|
allow:
|
|
- dependency-type: "production"
|
|
|
|
# Explorer frontend (npm)
|
|
- package-ecosystem: "npm"
|
|
directory: "/explorer"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
time: "03:30" # 3:30 AM UTC (9:00 AM IST)
|
|
open-pull-requests-limit: 10
|
|
reviewers:
|
|
- "KaifAhmad1"
|
|
assignees:
|
|
- "KaifAhmad1"
|
|
commit-message:
|
|
prefix: "security"
|
|
include: "scope"
|
|
labels:
|
|
- "dependencies"
|
|
- "javascript"
|
|
- "security"
|
|
allow:
|
|
- dependency-type: "production"
|
|
- dependency-type: "development"
|
|
|
|
# Docker dependencies (if you use Docker)
|
|
- package-ecosystem: "docker"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "wednesday"
|
|
time: "09:00"
|
|
open-pull-requests-limit: 2
|
|
reviewers:
|
|
- "KaifAhmad1"
|
|
assignees:
|
|
- "KaifAhmad1"
|
|
commit-message:
|
|
prefix: "docker"
|
|
include: "scope"
|
|
labels:
|
|
- "dependencies"
|
|
- "docker"
|
|
|
|
# Documentation dependencies
|
|
- package-ecosystem: "pip"
|
|
directory: "docs"
|
|
schedule:
|
|
interval: "monthly"
|
|
open-pull-requests-limit: 2
|
|
reviewers:
|
|
- "KaifAhmad1"
|
|
commit-message:
|
|
prefix: "docs"
|
|
include: "scope"
|
|
labels:
|
|
- "dependencies"
|
|
- "documentation"
|
|
|