mirror of
https://github.com/trailofbits/skills.git
synced 2026-09-14 14:28:48 +08:00
Dan Guido
ca08fc8a91
* Commit plugin lockfiles so Dependabot can do something useful The uv ecosystem config added in #206 pointed at four directories that declare PEP 621 ranges and carry no lockfile. With nothing to pin, Dependabot's only available action is raising the lower bound of an already-open range — which changes nothing about what installs and only drops support for older versions. It opened five such PRs within a minute of #206 merging (#208-#212), all no-ops: the existing ranges already resolved to exactly the versions being proposed as new floors. The one directory that did have a lockfile, constant-time-analysis, produced no PR at all, because there was genuinely nothing to update. That is the whole diagnosis. Lockfiles committed for the other four. .gitignore ignored uv.lock globally, which is why they were missing; constant-time-analysis's was tracked only because it predates the rule. Now scoped to the root file (ephemeral — there is no root pyproject.toml) with plugin lockfiles explicitly allowed, matching the pattern already used for .mcp.json. Also fixes two bugs #206 introduced: - The version-increment check failed all five Dependabot PRs, and Dependabot can neither bump a plugin version nor label its own PR, so every future dependency PR would have been permanently red. Exempted by actor. - The 'no-version-bump' label was documented in AGENTS.md and wired into validate.yml but never created, so the escape hatch did not exist. Created. * Re-run CI with the no-version-bump label applied The version-increment check fired on this PR: adding uv.lock under plugins/<name>/ counts as touching those plugins. Correct behaviour — the lockfiles pin exactly what the existing ranges already resolve to, so nothing changes for anyone installing these plugins, which is what the label is for. First real use of the escape hatch created in this same PR. * Fix the three findings from this PR's review A local uv setting leaked into all four new lockfiles. /etc/uv/uv.toml on ToB machine images sets exclude-newer = "1 week", so every lock carried an [options] block with exclude-newer-span = "P1W" and pinned versions resolved a week stale — diverging from constant-time-analysis/uv.lock, which predates this PR and has no such block. Regenerated with UV_NO_CONFIG=1. That cooldown is the org's supply-chain posture and it belongs in dependabot.yml's 'cooldown: default-days: 7', where it already is; baking it into committed lockfiles was my environment leaking, not a decision. "EVERY directory here must carry a committed uv.lock" was enforced by a comment, which is precisely the anti-pattern AGENTS.md tells people to avoid. Now a validator check: it parses the uv ecosystem block out of dependabot.yml and asserts a uv.lock beside each listed directory. Scoped to that block rather than grepping for '- /plugins/...' so a future ecosystem's paths are not swept in, and it errors if the block exists but no directories parse out — otherwise the checker could inspect zero items and report clean, which is the exact failure it exists to prevent. Three self-test fixtures, and verified by deleting a real lockfile and confirming CI would go red. The Dependabot exemption keyed on github.actor, which on a synchronize event is whoever pushed. A human adding one commit to a Dependabot branch would re-arm the version check and turn the PR red — making the follow-up bump mandatory exactly where the comment says it is discretionary. Keyed on PR authorship now.
66 lines
2.5 KiB
YAML
66 lines
2.5 KiB
YAML
# Two defects fixed here, both of which made this file quieter than it looked:
|
|
#
|
|
# 1. There was a `pip` entry at `/` with nothing to update — there is no root
|
|
# pyproject.toml and uv.lock is gitignored (.gitignore:18). Dependabot was
|
|
# resolving an empty manifest and reporting nothing, indefinitely.
|
|
# 2. Two script directories carrying real dependencies were uncovered:
|
|
# trailmark's slicing-code-context (trailmark>=0.5,<0.6) and yara-authoring's
|
|
# rule scripts (yara-x>=0.10.0).
|
|
#
|
|
# Ecosystem is `uv`, not `pip`, per the house standard. Only directories with a
|
|
# pyproject.toml that declares dependencies are listed — c-review/scripts,
|
|
# rust-review/scripts and let-fate-decide's scripts have manifests but no runtime
|
|
# deps, so there is nothing for Dependabot to resolve. Add them if that changes.
|
|
#
|
|
# EVERY directory here must carry a committed uv.lock. Without one, Dependabot has
|
|
# nothing to pin and its only available action is raising the lower bound of an
|
|
# already-open range — which changes nothing about what installs and only drops
|
|
# support for older versions. That produced five no-op PRs (#208-#212, all closed)
|
|
# the first time this config ran; the one directory that had a lockfile produced
|
|
# none, because there was genuinely nothing to update.
|
|
#
|
|
# Python deps declared with PEP 723 inline metadata (the common pattern in this
|
|
# repo, including .github/scripts/) have no Dependabot ecosystem at all and stay
|
|
# manual. So do the pinned npm CLI versions in .github/workflows/validate.yml.
|
|
version: 2
|
|
|
|
updates:
|
|
- package-ecosystem: uv
|
|
directories:
|
|
- /plugins/constant-time-analysis
|
|
- /plugins/culture-index/skills/interpreting-culture-index/scripts
|
|
- /plugins/testing-handbook-skills/scripts
|
|
- /plugins/trailmark/skills/slicing-code-context/scripts
|
|
- /plugins/yara-authoring/skills/yara-rule-authoring/scripts
|
|
schedule:
|
|
interval: weekly
|
|
cooldown:
|
|
default-days: 7
|
|
# One PR per week rather than five. Majors stay separate so they get their own
|
|
# CI run and their own read of the release notes.
|
|
groups:
|
|
python-minor-patch:
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
commit-message:
|
|
prefix: deps
|
|
labels:
|
|
- dependencies
|
|
|
|
- package-ecosystem: github-actions
|
|
directory: /
|
|
schedule:
|
|
interval: weekly
|
|
cooldown:
|
|
default-days: 7
|
|
groups:
|
|
actions-minor-patch:
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
commit-message:
|
|
prefix: ci
|
|
labels:
|
|
- dependencies
|