From 8b0230a724a8028e6fb1cd4ce3382c53db9563fe Mon Sep 17 00:00:00 2001 From: Tobias Nyhuus Jensen Date: Sun, 16 Aug 2026 21:17:28 +0200 Subject: [PATCH] Harden workflows and adopt Dependabot --- .github/dependabot.yml | 38 +++++++++++ .github/workflows/auto-merge.yml | 6 +- .github/workflows/deploy-ftp.yml | 15 ++++- .github/workflows/pr-housekeeping.yml | 1 + .github/workflows/tests.yml | 3 + .gitignore | 11 ++++ renovate.json | 93 --------------------------- 7 files changed, 67 insertions(+), 100 deletions(-) create mode 100644 .github/dependabot.yml delete mode 100644 renovate.json diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..da3cf93 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,38 @@ +version: 2 + +updates: + - package-ecosystem: npm + directory: / + schedule: + interval: weekly + day: monday + time: "05:00" + timezone: Europe/Copenhagen + groups: + npm-minor-and-patch: + update-types: + - minor + - patch + assignees: + - 2biazdk + labels: + - dependencies + open-pull-requests-limit: 5 + versioning-strategy: increase + + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + day: monday + time: "05:15" + timezone: Europe/Copenhagen + groups: + github-actions: + patterns: + - "*" + assignees: + - 2biazdk + labels: + - dependencies + open-pull-requests-limit: 3 diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml index f8d9988..fd5c4b8 100644 --- a/.github/workflows/auto-merge.yml +++ b/.github/workflows/auto-merge.yml @@ -18,10 +18,8 @@ jobs: runs-on: ubuntu-latest if: > github.event.pull_request.draft == false && - ( - github.event.pull_request.user.login != 'renovate[bot]' || - contains(github.event.pull_request.labels.*.name, 'automerge') - ) + github.event.pull_request.user.login == '2biazdk' && + github.event.pull_request.head.repo.full_name == github.repository steps: - name: Enable auto-merge diff --git a/.github/workflows/deploy-ftp.yml b/.github/workflows/deploy-ftp.yml index 8a6bab4..0de577d 100644 --- a/.github/workflows/deploy-ftp.yml +++ b/.github/workflows/deploy-ftp.yml @@ -14,22 +14,31 @@ permissions: contents: read concurrency: - group: deploy-ftp-${{ github.ref }} + group: deploy-ftp-production cancel-in-progress: true jobs: deploy: name: Upload FTP build runs-on: ubuntu-latest + environment: + name: production + url: https://colorcontrast.forlaens.com if: > github.event_name == 'workflow_dispatch' || - (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success') + ( + github.event_name == 'workflow_run' && + github.event.workflow_run.conclusion == 'success' && + github.event.workflow_run.event == 'push' && + github.event.workflow_run.head_repository.full_name == github.repository && + github.event.workflow_run.head_branch == 'main' + ) steps: - name: Check out repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: - ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }} + ref: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || 'main' }} - name: Set up Node.js uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 diff --git a/.github/workflows/pr-housekeeping.yml b/.github/workflows/pr-housekeeping.yml index 8ea1960..a0945de 100644 --- a/.github/workflows/pr-housekeeping.yml +++ b/.github/workflows/pr-housekeeping.yml @@ -6,6 +6,7 @@ on: - opened - reopened - ready_for_review + - closed permissions: contents: write diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index fccb298..732f8ed 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -10,6 +10,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: true +permissions: + contents: read + jobs: check: name: Source check diff --git a/.gitignore b/.gitignore index 0304a32..71ac0f7 100644 --- a/.gitignore +++ b/.gitignore @@ -4,5 +4,16 @@ test-results/ .DS_Store npm-debug.log* +# Local configuration and credentials +.env +.env.* +!.env.example +*.key +*.pem +*.p12 +*.pfx +credentials.json +service-account*.json + # macOS/iCloud conflict copies * 2.* diff --git a/renovate.json b/renovate.json deleted file mode 100644 index fa69991..0000000 --- a/renovate.json +++ /dev/null @@ -1,93 +0,0 @@ -{ - "$schema": "https://docs.renovatebot.com/renovate-schema.json", - "extends": [ - "config:recommended", - ":dependencyDashboard", - ":semanticCommits", - "helpers:pinGitHubActionDigests", - "group:recommended", - "group:monorepos" - ], - "timezone": "Europe/Copenhagen", - "labels": [ - "dependencies" - ], - "schedule": [ - "before 6am every weekday" - ], - "prHourlyLimit": 2, - "prConcurrentLimit": 10, - "rangeStrategy": "bump", - "lockFileMaintenance": { - "enabled": true, - "schedule": [ - "before 6am on monday" - ], - "automerge": true, - "automergeType": "pr", - "platformAutomerge": true, - "addLabels": [ - "automerge" - ] - }, - "packageRules": [ - { - "description": "Wait three days before npm updates are eligible for merge.", - "matchDatasources": [ - "npm" - ], - "minimumReleaseAge": "3 days" - }, - { - "description": "Automerge stable non-major updates after CI passes.", - "matchUpdateTypes": [ - "minor", - "patch", - "pin", - "digest" - ], - "matchCurrentVersion": "!/^0/", - "automerge": true, - "automergeType": "pr", - "platformAutomerge": true, - "addLabels": [ - "automerge" - ] - }, - { - "description": "Automerge non-major updates for 0.x packages after CI passes.", - "matchUpdateTypes": [ - "minor", - "patch", - "pin", - "digest" - ], - "matchCurrentVersion": "/^0/", - "automerge": true, - "automergeType": "pr", - "platformAutomerge": true, - "addLabels": [ - "automerge" - ] - }, - { - "description": "Require manual review for major updates.", - "matchUpdateTypes": [ - "major" - ], - "automerge": false, - "addLabels": [ - "major" - ] - } - ], - "dependencyDashboard": true, - "dependencyDashboardTitle": "Dependency Dashboard", - "dependencyDashboardLabels": [ - "dependencies" - ], - "assignees": [ - "2biazdk" - ], - "internalChecksFilter": "strict" -}