chore: repo hygiene — PR template, Dependabot, SHA-pinned actions#137
Merged
Conversation
Three gaps found in a settings audit of the public repo: - No pull request template. Added one that asks for the test evidence (coreverify / swift test / xcodebuild / device) and makes the README non-negotiables an explicit checklist rather than something a contributor has to go and find. - No Dependabot config. The repo has no third-party package manifest, so the only pinned versions are the CI workflow's actions — this tracks those weekly, matching proton-bridge-mcp. - CI actions were pinned to floating major tags (@v4). Pinned to commit SHAs with the version in a trailing comment, so a compromised tag can't silently change what runs. Dependabot now keeps the SHAs current. No behaviour change to the app or to what CI actually executes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The two xcodebuild matrix destinations become the status-check names on branch protection. The comment right above them invites bumping 18.5 when the runner image moves on, which would rename a required check — the old name stays required, never reports, and main locks. Says so at the spot where someone would do it. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
Fills three gaps found in a settings audit of the public repo. No app code, no change to what CI executes.
.github/pull_request_template.md— none existed. Asks for the test evidence and turns the README non-negotiables into a checklist..github/dependabot.yml— none existed. There is no third-party package manifest here, so it tracks the CI actions weekly. Matchesproton-bridge-mcp.actions/checkoutandactions/cachewere on floating@v4tags. Now pinned to commit SHAs (v4.4.0 and v4.3.0) with the version in a trailing comment, so a moved tag cannot change what runs. Dependabot keeps them current from here.How it was tested
CI on this PR is the test. The workflow change is exercised by the run itself, since the pinned SHAs are what check out the code and restore the cache. Green across all four contexts means the pins resolve.
Note
The audit also found that branch protection on
maindid not require any status checks, despite the comment at the top ofci.ymlsaying it did. That is a repository setting rather than a file, and is being fixed separately.🤖 Generated with Claude Code