Unpushed commits (local main ahead of origin/main) - #21
Conversation
There was a problem hiding this comment.
Pull request overview
Adds/updates repository maintenance metadata (security/contribution docs, Dependabot configuration, and GitHub Actions versions/permissions) to align the repo with common open-source automation patterns.
Changes:
- Add root-level
SECURITY.mdandCONTRIBUTING.md. - Update GitHub Actions workflows for code style fixing, dependency review, and Dependabot auto-merge.
- Expand Dependabot configuration (more ecosystems, daily cadence, grouping, and major-update ignore rules).
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| SECURITY.md | Adds a security policy document at repo root. |
| CONTRIBUTING.md | Adds contribution guidelines at repo root. |
| .github/workflows/fix-php-code-style-issues.yml | Updates action versions and sets contents: write permission for auto-commit. |
| .github/workflows/dependency-review.yml | Updates checkout action version used in dependency review workflow. |
| .github/workflows/dependabot-auto-merge.yml | Bumps Dependabot metadata action version. |
| .github/dependabot.yml | Moves to daily updates, adds grouping/ignore rules, and adds npm/composer ecosystems. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| @@ -0,0 +1,3 @@ | |||
| # Security Policy | |||
|
|
|||
| If you discover any security related issues, please email info@codebar.ch instead of using the issue tracker. | |||
There was a problem hiding this comment.
This file duplicates the existing .github/SECURITY.md (same content). Having both copies increases the chance they diverge; consider keeping only one canonical SECURITY policy file (either root or .github/) and removing the other.
| If you discover any security related issues, please email info@codebar.ch instead of using the issue tracker. | |
| The canonical, up-to-date security policy for this project is maintained in [`.github/SECURITY.md`](.github/SECURITY.md). | |
| If you discover any security related issues, please follow the instructions in that file. |
| # Contributing | ||
|
|
||
| Contributions are **welcome** and will be fully **credited**. | ||
|
|
||
| Please read and understand the contribution guide before creating an issue or pull request. |
There was a problem hiding this comment.
This file duplicates the existing .github/CONTRIBUTING.md (same content). Keeping two copies makes it easy for contribution guidance to get out of sync; consider removing one and relying on a single canonical location.
| ## Requirements | ||
|
|
||
| If the project maintainer has any additional requirements, you will find them listed here. | ||
|
|
||
| - **[PSR-2 Coding Standard](https://github.com/php-fig/fig-standards/blob/master/accepted/PSR-2-coding-style-guide.md)** - The easiest way to apply the conventions is to install [PHP Code Sniffer](https://pear.php.net/package/PHP_CodeSniffer). | ||
|
|
||
| - **Add tests!** - Your patch won't be accepted if it doesn't have tests. |
There was a problem hiding this comment.
The requirements section references PSR-2 and suggests PHP CodeSniffer, but this repo’s tooling uses Laravel Pint (see composer.json script format: vendor/bin/pint). To avoid misleading contributors, update this guidance to match the actual formatter/linter used in the project (and/or the coding standard Pint enforces).
| - package-ecosystem: "npm" | ||
| directory: "/" | ||
| schedule: | ||
| interval: "daily" | ||
| allow: | ||
| - dependency-type: "direct" | ||
| ignore: | ||
| - dependency-name: "*" | ||
| update-types: [ "version-update:semver-major" ] | ||
| groups: | ||
| minor-and-patch: | ||
| update-types: [ "minor", "patch" ] | ||
|
|
There was a problem hiding this comment.
This adds an npm Dependabot update config for /, but the repository does not contain an npm manifest (no package.json in the root). This will cause Dependabot to report a configuration/dependency-file error; remove the npm entry or point it at the directory that actually contains the npm project.
| - package-ecosystem: "npm" | |
| directory: "/" | |
| schedule: | |
| interval: "daily" | |
| allow: | |
| - dependency-type: "direct" | |
| ignore: | |
| - dependency-name: "*" | |
| update-types: [ "version-update:semver-major" ] | |
| groups: | |
| minor-and-patch: | |
| update-types: [ "minor", "patch" ] |
Local main was 3 commit(s) ahead of origin/main. Opened from update-opensource-active.sh for review.