chore: add Dependabot security-only update config by don-petry · Pull Request #37 · oneirosoft/dagger

don-petry · 2026-04-03T18:37:53Z

Why?

Unpatched dependencies are the most common attack vector for open-source projects. This PR establishes automated security hygiene: Dependabot monitors for known vulnerabilities, a multi-ecosystem audit workflow runs on every PR, and low-risk security patches are auto-merged to reduce maintainer toil.

Summary

Add .github/dependabot.yml with cargo and github-actions ecosystems configured for security-only updates (open-pull-requests-limit: 0 disables version-update PRs while security alerts still function)
Add dependabot-automerge.yml workflow to auto-approve and squash-merge patch/minor Dependabot PRs using --auto (waits for CI to pass before merging)
Add dependency-audit.yml workflow with ecosystem auto-detection that runs cargo audit, npm/pnpm audit, pip-audit, or govulncheck as appropriate on every push/PR to main
Pinned runner images to ubuntu-24.04 for reproducibility
Uses cargo install --locked cargo-audit for deterministic tool versions

Aligns the dagger repo with the petry-projects org standard for dependency security.

Test plan

Dependency audit workflow detects cargo ecosystem and runs cargo audit
Verify Dependabot starts monitoring for security advisories
Confirm automerge workflow triggers on Dependabot PRs and waits for CI

🤖 Generated with Claude Code

Add Dependabot configuration for cargo and github-actions ecosystems with weekly schedule. Include automerge workflow for patch/minor updates and dependency-audit workflow for vulnerability scanning. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

Adds repository automation to manage and audit dependencies via Dependabot plus CI workflows, aiming to standardize dependency security handling for this repo.

Changes:

Added .github/dependabot.yml configuring Dependabot updates for Cargo and GitHub Actions.
Added a dependabot-automerge workflow to auto-approve and squash-merge certain Dependabot PRs.
Added a dependency-audit workflow to scan for known vulnerabilities across detected ecosystems on pushes/PRs to main.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

File	Description
`.github/dependabot.yml`	Configures scheduled Dependabot updates and labeling for Cargo and GitHub Actions.
`.github/workflows/dependabot-automerge.yml`	Automates approval/merge of qualifying Dependabot PRs using a GitHub App token.
`.github/workflows/dependency-audit.yml`	Adds an ecosystem-detecting vulnerability audit workflow (npm/Go/Cargo/Python).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-03T18:41:24Z

.github/workflows/dependency-audit.yml

+  audit-cargo:
+    name: cargo audit
+    needs: detect
+    if: needs.detect.outputs.cargo == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit
+
+      - name: Audit Cargo dependencies
+        run: cargo audit


audit-cargo uses cargo install/cargo audit but the workflow never installs a Rust toolchain. On GitHub-hosted runners, Rust/cargo isn’t guaranteed to be present, so this job can fail even when Cargo.lock exists (which will trigger it in this repo). Add a Rust toolchain setup step (and ideally the Cargo cache) before invoking cargo, consistent with the existing CI workflow.

Addressed — added Swatinem/rust-cache@v2 step after dtolnay/rust-toolchain@stable in the cargo audit job.

Copilot · 2026-04-03T18:41:24Z

.github/workflows/dependency-audit.yml

+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit


cargo install cargo-audit installs the latest published version each run, which is non-deterministic and can break the workflow unexpectedly. Prefer installing with a locked dependency set (e.g., --locked) or using an action that pins the tool version; also consider caching to avoid repeated compilation.

Suggested change

run: cargo install cargo-audit

run: cargo install --locked cargo-audit

Addressed — cargo install cargo-audit@0.22.1 --locked was already in place; confirmed no change needed.

Copilot · 2026-04-03T18:41:24Z

.github/workflows/dependency-audit.yml

+  detect:
+    name: Detect ecosystems
+    runs-on: ubuntu-latest
+    outputs:


This uses ubuntu-latest for all jobs, while the repo’s existing workflows pin to specific runner images (e.g., ubuntu-24.04). Using ubuntu-latest can introduce breaking environment changes over time; consider pinning to the same runner image used elsewhere in the repo for consistency and reproducibility.

Addressed — all runs-on in dependency-audit.yml pinned to ubuntu-24.04, consistent with ci.yml and release.yml.

Copilot · 2026-04-03T18:41:24Z

.github/workflows/dependabot-automerge.yml

+          steps.metadata.outputs.dependency-type == 'indirect'
+        run: |
+          gh pr review --approve "$PR_URL"
+          gh pr merge --squash --admin "$PR_URL"


gh pr merge --admin can bypass branch protection requirements and merges immediately rather than waiting for required checks to pass. For safer automation, avoid --admin and use auto-merge behavior that waits for checks/reviews (e.g., enable auto-merge for the PR) so Dependabot updates don’t land without CI/required status checks.

Suggested change

gh pr merge --squash --admin "$PR_URL"

gh pr merge --auto --squash "$PR_URL"

Addressed — --auto was already in place instead of --admin; confirmed no change needed.

Copilot · 2026-04-03T18:41:25Z

.github/dependabot.yml

+version: 2
+updates:
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "security"
+      - "dependencies"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "security"
+      - "dependencies"


PR description says this change aligns the repo to “security-only dependency updates”, but this config enables scheduled weekly version updates for cargo and GitHub Actions (not security-only) and applies a security label to all of them. If the intent is truly security-only, remove/disable scheduled version updates (or add ignore rules to exclude non-security updates) and avoid labeling non-security PRs as security.

Addressed — open-pull-requests-limit: 0 was already set for cargo (the only app ecosystem configured). Added file-level and inline comments explaining the security-only strategy: limit 0 disables version-update PRs while Dependabot security alerts still create PRs for known vulnerabilities.

Copilot · 2026-04-03T18:41:25Z

.github/workflows/dependabot-automerge.yml

+
+jobs:
+  dependabot:
+    runs-on: ubuntu-latest


This workflow also uses ubuntu-latest, while other workflows in the repo pin runner images (e.g., ubuntu-24.04). Pinning improves reproducibility and reduces the chance of runner image changes breaking the automation.

Suggested change

runs-on: ubuntu-latest

runs-on: ubuntu-24.04

Addressed — runs-on in dependabot-automerge.yml pinned to ubuntu-24.04.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

- Pin all runs-on to ubuntu-24.04 for consistency with ci.yml/release.yml - Add Swatinem/rust-cache@v2 to cargo audit job - Add comments to dependabot.yml explaining the security-only strategy (open-pull-requests-limit: 0 disables version PRs while security alerts still function) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings April 3, 2026 18:37

Copilot started reviewing on behalf of don-petry April 3, 2026 18:38 View session

Copilot AI reviewed Apr 3, 2026

View reviewed changes

DJ and others added 4 commits April 3, 2026 11:46

fix: update to latest security-only standards (limit:0, improved audit)

c304a56

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix: bump cargo-audit to 0.22.1 for CVSS 4.0 support

763a4a8

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

chore: strip template header comments from deployed workflows

14f99d3

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

	run: cargo install cargo-audit
	run: cargo install --locked cargo-audit

	gh pr merge --squash --admin "$PR_URL"
	gh pr merge --auto --squash "$PR_URL"

Conversation

don-petry commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why?

Summary

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

don-petry Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

don-petry Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

don-petry Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

don-petry Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

don-petry Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

don-petry Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

don-petry commented Apr 3, 2026 •

edited

Loading