mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-09-11 04:01:32 +00:00
KaifAhmad1
854f7cbb8c
- Configured bi-weekly security updates with manual review by @KaifAhmad1 - Implemented automated security scans (Monday & Thursday at 7 AM IST) with Bandit, Safety, Semgrep - Added security-critical package grouping (cryptography, requests, urllib3, certifi, pyopenssl) - Enterprise-grade security with audit trail, compliance features, and zero auto-merge - Optimized IST timezone scheduling (Security scans: 7 AM IST, PRs: 9 AM IST) - Aligned with new Dependabot features: open-source proxy support, smart dependency grouping for Snowflake/Arrow/benchmark features, private registry support, semantic commit prefixes, and latest GitHub security best practices - Added comprehensive security workflow for automated vulnerability scanning - Updated CHANGELOG.md with security configuration details Security enhancements maintain full manual control while providing automated vulnerability protection and enterprise-grade compliance features.
154 lines
3.6 KiB
YAML
154 lines
3.6 KiB
YAML
version: 2
|
|
registries:
|
|
# Configure private registries if needed
|
|
# npm-registry:
|
|
# type: npm-registry
|
|
# url: https://registry.npmjs.org
|
|
# token: ${{secrets.NPM_TOKEN}}
|
|
|
|
updates:
|
|
# Core Python dependencies
|
|
- package-ecosystem: "pip"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "bi-weekly" # Bi-weekly for security
|
|
day: "monday"
|
|
time: "03:30" # 3:30 AM UTC (9:00 AM IST)
|
|
open-pull-requests-limit: 10 # Higher limit for security updates
|
|
reviewers:
|
|
- "KaifAhmad1"
|
|
assignees:
|
|
- "KaifAhmad1"
|
|
commit-message:
|
|
prefix: "security"
|
|
include: "scope"
|
|
labels:
|
|
- "dependencies"
|
|
- "python"
|
|
- "security"
|
|
allow:
|
|
- dependency-type: "production"
|
|
- dependency-type: "development"
|
|
# Prioritize security updates
|
|
priority: "security"
|
|
# Allow all security-related updates
|
|
allow:
|
|
- dependency-type: "production"
|
|
- dependency-type: "development"
|
|
ignore:
|
|
# Only ignore major version updates for stability-critical packages
|
|
- dependency-name: "torch"
|
|
update-types: ["version-update:semver-major"]
|
|
- dependency-name: "transformers"
|
|
update-types: ["version-update:semver-major"]
|
|
# Group new feature dependencies
|
|
groups:
|
|
security-critical:
|
|
patterns:
|
|
- "cryptography"
|
|
- "requests"
|
|
- "urllib3"
|
|
- "certifi"
|
|
- "pyopenssl"
|
|
dependency-type: "direct"
|
|
snowflake-features:
|
|
patterns:
|
|
- "snowflake-connector-python"
|
|
- "cryptography"
|
|
arrow-features:
|
|
patterns:
|
|
- "pyarrow"
|
|
benchmark-tools:
|
|
patterns:
|
|
- "pytest-benchmark"
|
|
- "pytest-cov"
|
|
|
|
# GitHub Actions
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "monday"
|
|
time: "09:00"
|
|
open-pull-requests-limit: 3
|
|
reviewers:
|
|
- "KaifAhmad1"
|
|
assignees:
|
|
- "KaifAhmad1"
|
|
commit-message:
|
|
prefix: "ci"
|
|
include: "scope"
|
|
labels:
|
|
- "dependencies"
|
|
- "github-actions"
|
|
- "ci"
|
|
|
|
# Optional dependencies (separate schedule for stability)
|
|
- package-ecosystem: "pip"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "bi-weekly"
|
|
day: "friday"
|
|
time: "09:00"
|
|
target-branch: "main"
|
|
open-pull-requests-limit: 3
|
|
reviewers:
|
|
- "KaifAhmad1"
|
|
assignees:
|
|
- "KaifAhmad1"
|
|
commit-message:
|
|
prefix: "deps"
|
|
include: "scope"
|
|
labels:
|
|
- "dependencies"
|
|
- "python"
|
|
- "optional"
|
|
allow:
|
|
- dependency-type: "production"
|
|
update-types: ["version-update:semver-patch", "version-update:semver-minor"]
|
|
|
|
# Docker dependencies (if you use Docker)
|
|
- package-ecosystem: "docker"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
day: "wednesday"
|
|
time: "09:00"
|
|
open-pull-requests-limit: 2
|
|
reviewers:
|
|
- "KaifAhmad1"
|
|
assignees:
|
|
- "KaifAhmad1"
|
|
commit-message:
|
|
prefix: "docker"
|
|
include: "scope"
|
|
labels:
|
|
- "dependencies"
|
|
- "docker"
|
|
|
|
# Documentation dependencies
|
|
- package-ecosystem: "pip"
|
|
directory: "docs"
|
|
schedule:
|
|
interval: "monthly"
|
|
day: "1"
|
|
time: "09:00"
|
|
open-pull-requests-limit: 2
|
|
reviewers:
|
|
- "KaifAhmad1"
|
|
commit-message:
|
|
prefix: "docs"
|
|
include: "scope"
|
|
labels:
|
|
- "dependencies"
|
|
- "documentation"
|
|
|
|
# Configure Dependabot proxy for private registries (if needed)
|
|
# This uses the new open source Dependabot Proxy
|
|
# proxy:
|
|
# github-token: ${{secrets.DEPENDABOT_PROXY_TOKEN}}
|
|
# registries:
|
|
# - npm-registry
|
|
# - private-pypi
|
|
|