From 3218f79394a9899ca178c5b6016c2918d1e437a0 Mon Sep 17 00:00:00 2001 From: Alain Prasquier Date: Wed, 13 May 2026 11:35:11 +0300 Subject: [PATCH] fix(ci): route Dependabot PRs to develop, not main --- .github/dependabot.yml | 2 ++ .github/workflows/security-scan.yml | 4 ++-- SECURITY.md | 2 +- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f6d2780..5446885 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -2,6 +2,7 @@ version: 2 updates: - package-ecosystem: "pip" directory: "/" + target-branch: "develop" schedule: interval: "weekly" day: "monday" @@ -21,6 +22,7 @@ updates: - package-ecosystem: "github-actions" directory: "/" + target-branch: "develop" schedule: interval: "weekly" day: "monday" diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml index 8e1aef8..2180804 100644 --- a/.github/workflows/security-scan.yml +++ b/.github/workflows/security-scan.yml @@ -2,9 +2,9 @@ name: Security scan on: pull_request: - branches: [main] + branches: [main, develop] push: - branches: [main] + branches: [main, develop] schedule: - cron: '23 6 * * *' diff --git a/SECURITY.md b/SECURITY.md index a22ef75..ebe19a6 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -28,6 +28,6 @@ This repository implements the following controls: - Trusted Publishing (OIDC) for PyPI releases — no long-lived publish tokens - Required reviewer approval on the `pypi` environment before publish secrets are exposed - Third-party GitHub Actions pinned to commit SHAs -- OSV-Scanner in CI (daily + on every PR) against the OSV.dev malicious package index +- OSV-Scanner in CI (daily + on every PR targeting `main` or `develop`) against the OSV.dev malicious package index If you observe a deviation from this posture, please report it via the private channel above.