From ccc2c51c2bd8158c9e4965c49163ae63c1288f86 Mon Sep 17 00:00:00 2001 From: David Date: Sun, 27 Sep 2026 08:00:45 -0400 Subject: [PATCH 1/3] ci: add Dependabot and security checks --- .github/dependabot.yml | 31 ++++++++++++++++ .github/workflows/origin89-security.yml | 47 +++++++++++++++++++++++++ .github/zizmor.yml | 6 ++++ 3 files changed, 84 insertions(+) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/origin89-security.yml create mode 100644 .github/zizmor.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..b00ad32 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,31 @@ +# See origin89hq/engineering docs/dependencies.md. +version: 2 + +updates: + - package-ecosystem: github-actions + directories: [/, /.github/actions/setup-node] + schedule: + interval: weekly + cooldown: + default-days: 3 + groups: + actions: + patterns: ["*"] + update-types: [minor, patch] + commit-message: + prefix: ci + + - package-ecosystem: npm + directory: / + schedule: + interval: weekly + # At least pnpm's minimumReleaseAge, or the frozen install rejects the update. + cooldown: + default-days: 3 + groups: + npm: + patterns: ["*"] + update-types: [minor, patch] + commit-message: + prefix: chore + include: scope diff --git a/.github/workflows/origin89-security.yml b/.github/workflows/origin89-security.yml new file mode 100644 index 0000000..408bd69 --- /dev/null +++ b/.github/workflows/origin89-security.yml @@ -0,0 +1,47 @@ +# See origin89hq/engineering docs/dependencies.md. +name: origin89-security + +on: + push: + branches: [main] + pull_request: + # New advisories arrive without a code change. + schedule: + - cron: "17 6 * * 1" + +permissions: + contents: read + +jobs: + dependency-review: + if: github.event_name == 'pull_request' + runs-on: ubuntu-latest + timeout-minutes: 5 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 + with: + fail-on-severity: moderate + fail-on-scopes: runtime, development + # Checked only for dependencies the pull request adds. Unknown + # licenses are reported without failing. + allow-licenses: >- + 0BSD, Apache-2.0, BlueOak-1.0.0, BSD-2-Clause, BSD-3-Clause, + CC-BY-4.0, CC0-1.0, ISC, MIT, MPL-2.0, Python-2.0, Unicode-3.0, + Unlicense, Zlib + + zizmor: + runs-on: ubuntu-latest + timeout-minutes: 5 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 + with: + version: 1.30.1 + advanced-security: false + annotations: true + min-severity: medium diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..a4212ff --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,6 @@ +# Origin89 uses a 3-day Dependabot cooldown to match pnpm's minimumReleaseAge; +# see origin89hq/engineering docs/dependencies.md. +rules: + dependabot-cooldown: + config: + days: 3 From 8cb464f24fa343b8bb5aba798768b576b1707267 Mon Sep 17 00:00:00 2001 From: David Date: Sun, 27 Sep 2026 08:02:18 -0400 Subject: [PATCH 2/3] ci: use a seven-day Dependabot cooldown --- .github/dependabot.yml | 4 ++-- .github/zizmor.yml | 6 ------ 2 files changed, 2 insertions(+), 8 deletions(-) delete mode 100644 .github/zizmor.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index b00ad32..832f799 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,7 +7,7 @@ updates: schedule: interval: weekly cooldown: - default-days: 3 + default-days: 7 groups: actions: patterns: ["*"] @@ -21,7 +21,7 @@ updates: interval: weekly # At least pnpm's minimumReleaseAge, or the frozen install rejects the update. cooldown: - default-days: 3 + default-days: 7 groups: npm: patterns: ["*"] diff --git a/.github/zizmor.yml b/.github/zizmor.yml deleted file mode 100644 index a4212ff..0000000 --- a/.github/zizmor.yml +++ /dev/null @@ -1,6 +0,0 @@ -# Origin89 uses a 3-day Dependabot cooldown to match pnpm's minimumReleaseAge; -# see origin89hq/engineering docs/dependencies.md. -rules: - dependabot-cooldown: - config: - days: 3 From 9bfcfa279f8f993a644391d1e49a535a833d09ec Mon Sep 17 00:00:00 2001 From: David Date: Sun, 27 Sep 2026 08:06:41 -0400 Subject: [PATCH 3/3] ci: pin pnpm/action-setup to its v6 commit --- .github/actions/setup-node/action.yml | 2 +- .github/workflows/publish-cloud.yml | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/actions/setup-node/action.yml b/.github/actions/setup-node/action.yml index 2d886ed..60ae19e 100644 --- a/.github/actions/setup-node/action.yml +++ b/.github/actions/setup-node/action.yml @@ -7,7 +7,7 @@ runs: with: node-version-file: .node-version package-manager-cache: false - - uses: pnpm/action-setup@f520eceda224fe1a4aed5a2a27a194379a409996 # v6 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 with: run_install: false cache: true diff --git a/.github/workflows/publish-cloud.yml b/.github/workflows/publish-cloud.yml index 027632d..6beabb4 100644 --- a/.github/workflows/publish-cloud.yml +++ b/.github/workflows/publish-cloud.yml @@ -30,7 +30,7 @@ jobs: with: node-version-file: .node-version package-manager-cache: false - - uses: pnpm/action-setup@f520eceda224fe1a4aed5a2a27a194379a409996 # v6 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 with: run_install: false - run: pnpm install --frozen-lockfile --ignore-scripts @@ -56,7 +56,7 @@ jobs: with: node-version-file: .node-version package-manager-cache: false - - uses: pnpm/action-setup@f520eceda224fe1a4aed5a2a27a194379a409996 # v6 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 with: run_install: false - run: pnpm install --frozen-lockfile @@ -85,7 +85,7 @@ jobs: with: node-version-file: .node-version package-manager-cache: false - - uses: pnpm/action-setup@f520eceda224fe1a4aed5a2a27a194379a409996 # v6 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 with: run_install: false - run: pnpm install --frozen-lockfile @@ -114,7 +114,7 @@ jobs: with: node-version-file: .node-version package-manager-cache: false - - uses: pnpm/action-setup@f520eceda224fe1a4aed5a2a27a194379a409996 # v6 + - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 with: run_install: false - run: pnpm install --frozen-lockfile --ignore-scripts