Skip to content

ci: 釘住 action 的 commit SHA，並讓 dependabot 分組、不提 major #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hoshimoe merged 1 commit into from
Aug 11, 2026
Merged

ci: 釘住 action 的 commit SHA，並讓 dependabot 分組、不提 major #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 26 additions & 3 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,15 +6,38 @@
# ——上游改了 tag 指向就換掉了我們跑的程式，沒有任何審閱——這裡把那件事換成
# 一個看得見、審得到的 PR。
#
# **PR 是草稿以外的形狀由 workspace `AGENTS.md` §1.9 管**：Dependabot 開的是
# 正式 PR，所以它會跑 CI，紅了就是要處理的。
# ## 為什麼要分組
#
# 沒有 `groups` 時 Dependabot **一個相依開一個 PR**，而
# `github/codeql-action` 的四個子 action（init／autobuild／analyze／upload-sarif）
# 各算一個——光 CodeQL 就是四個 PR，加上 trivy 是五個，乘以十二個倉庫。
# 那不是「更新被看見」，那是更新被淹掉。
#
# 分組之後每個生態系每週最多一個 PR。
#
# ## 為什麼不收 major
#
# major 是一次**遷移**，不是一次更新，而 Dependabot 判斷不了相依圖收不收得下。
# 實測（2026-08-11）：它替四個倉庫提了 `typescript` 5.9 → 7.0，
# 而 `@astrojs/check` 的 peer 範圍是 `^5 || ^6`——`npm ci` 直接 ERESOLVE，
# **那些 PR 沒有任何一顆有機會變綠**。
#
# 一個沒有人能處理的紅燈，最後會被學會忽略，連同它旁邊那個真的紅燈一起
# （見 workspace `decisions/process/掃描的紅燈要有人處理得了.md`）。
# 所以 major 不自動開 PR；要升的時候由人讀 changelog、一次做完。
#
# **這不影響有漏洞的相依**：那走 Dependabot alerts 與 security updates，
# 與這裡的版本更新是兩條路。
version: 2
updates:
# workflow 裡釘住的 action SHA。
# workflow 裡釘住的 action SHA。全部收在一個 PR 裡。
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
open-pull-requests-limit: 5
commit-message:
prefix: "ci"
groups:
actions:
patterns: ["*"]
4 changes: 2 additions & 2 deletions .github/workflows/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,7 +98,7 @@ jobs:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

- name: 掃描相依與設定
uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
with:
scan-type: fs
scanners: vuln,secret,misconfig
Expand All @@ -111,7 +111,7 @@ jobs:

- name: 上傳到 code scanning（沒有 GHAS 時會失敗，不影響結論）
continue-on-error: true
uses: github/codeql-action/upload-sarif@9e3211c9a3b9311dfe05da2ed48eea3386f042dd # v4.37.6
uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
with:
sarif_file: trivy.sarif
category: trivy
Expand Down