27e4382482
- Created `pr_461_remediation_complete.md` detailing the final remediation status, including bug fixes, test results, and coverage metrics. - Added `pr_461_vulnerability_comment.md` summarizing the supply chain vulnerabilities accepted for PR #461, including risk assessments and mitigation strategies. - Established `VULNERABILITY_ACCEPTANCE.md` to formally document the acceptance of 9 vulnerabilities in Alpine Linux packages, outlining the rationale, monitoring plans, and compliance with industry standards. These documents ensure transparency and provide a clear audit trail for the vulnerability management process associated with PR #461.
88 lines
2.2 KiB
JSON
88 lines
2.2 KiB
JSON
{
|
|
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
|
"extends": [
|
|
"config:recommended",
|
|
":semanticCommits",
|
|
":separateMultipleMajorReleases",
|
|
"helpers:pinGitHubActionDigests"
|
|
],
|
|
"baseBranchPatterns": [
|
|
"development"
|
|
],
|
|
"timezone": "America/New_York",
|
|
"dependencyDashboard": true,
|
|
"prConcurrentLimit": 10,
|
|
"prHourlyLimit": 0,
|
|
"labels": [
|
|
"dependencies"
|
|
],
|
|
|
|
"rebaseWhen": "auto",
|
|
|
|
"vulnerabilityAlerts": {
|
|
"enabled": true
|
|
},
|
|
|
|
"schedule": [
|
|
"before 8am on monday"
|
|
],
|
|
|
|
"rangeStrategy": "bump",
|
|
"automerge": true,
|
|
"automergeType": "pr",
|
|
"platformAutomerge": true,
|
|
|
|
"customManagers": [
|
|
{
|
|
"customType": "regex",
|
|
"description": "Track Go dependencies patched in Dockerfile for Caddy CVE fixes",
|
|
"managerFilePatterns": [
|
|
"/^Dockerfile$/"
|
|
],
|
|
"matchStrings": [
|
|
"#\\s*renovate:\\s*datasource=go\\s+depName=(?<depName>[^\\s]+)\\s*\\n\\s*go get (?<depName2>[^@]+)@v(?<currentValue>[^\\s|]+)"
|
|
],
|
|
"datasourceTemplate": "go",
|
|
"versioningTemplate": "semver"
|
|
}
|
|
],
|
|
|
|
"packageRules": [
|
|
{
|
|
"description": "THE MEGAZORD: Group ALL non-major updates (NPM, Docker, Go, Actions) into one weekly PR",
|
|
"matchPackagePatterns": ["*"],
|
|
"matchUpdateTypes": [
|
|
"minor",
|
|
"patch",
|
|
"pin",
|
|
"digest"
|
|
],
|
|
"groupName": "weekly-non-major-updates",
|
|
"automerge": true
|
|
},
|
|
{
|
|
"description": "Preserve your custom Caddy patch labels but allow them to group into the weekly PR",
|
|
"matchManagers": ["custom.regex"],
|
|
"matchFileNames": ["Dockerfile"],
|
|
"labels": ["caddy-patch", "security"],
|
|
"matchPackageNames": [
|
|
"/expr-lang/expr/",
|
|
"/quic-go/quic-go/",
|
|
"/smallstep/certificates/"
|
|
]
|
|
},
|
|
{
|
|
"description": "Docker: keep Caddy within v2 (no automatic jump to v3)",
|
|
"matchManagers": ["dockerfile"],
|
|
"matchPackageNames": ["caddy"],
|
|
"allowedVersions": "<3.0.0"
|
|
},
|
|
{
|
|
"description": "Safety: Keep MAJOR updates separate and require manual review",
|
|
"matchUpdateTypes": ["major"],
|
|
"automerge": false,
|
|
"labels": ["manual-review"]
|
|
}
|
|
]
|
|
}
|