mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
af2f2c7abe
tools/quality runs jscpd (5.3.0, pinned with a lockfile like rules/scripts) over the C# and TypeScript sources, tests and generated files excluded, at 100 tokens. The 95 existing clones are frozen in jscpd-baseline.json. A clone that is not in the baseline fails, and so does a baseline entry whose clone is gone: jscpd only reports missing fingerprints, and a stale one would let the same copy come back unnoticed. jscpd scans an LF-normalized copy of the tracked and new files under src/, because with CRLF in a Windows checkout some JSX clones hash differently than on the Linux runner; local runs and CI now see the same 95 clones. At 70 tokens a sixth of all clones were identical using blocks, hence 100. Gate proven both ways with an untracked probe file: a third copy of an existing helper fails with its location, and a baseline entry without its clone fails. New CI job "Duplicate code"; Dependabot watches tools/quality with the usual 7-day cooldown. Locally: npm run dup (check), npm run dup:baseline (shrink). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
117 lines
3.6 KiB
YAML
117 lines
3.6 KiB
YAML
version: 2
|
|
|
|
# Cooldown: a version is proposed only once it has been public for 7 days, so a
|
|
# release that is yanked or found malicious within its first week never reaches a
|
|
# PR. Security updates are exempt from the cooldown by Dependabot's own rules.
|
|
#
|
|
# Grouping: every ecosystem gets one batched PR for minor/patch version
|
|
# updates and one batched PR for security updates. Groups apply to version
|
|
# updates only by default, so the security-updates groups are declared
|
|
# explicitly — otherwise every advisory lands as its own PR.
|
|
|
|
updates:
|
|
- package-ecosystem: nuget
|
|
directory: /
|
|
schedule:
|
|
interval: weekly
|
|
cooldown:
|
|
default-days: 7
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
dotnet:
|
|
patterns: ['*']
|
|
update-types: [minor, patch]
|
|
dotnet-security:
|
|
applies-to: security-updates
|
|
patterns: ['*']
|
|
|
|
- package-ecosystem: npm
|
|
directory: /src/Web/autopilot-monitor-web
|
|
schedule:
|
|
interval: weekly
|
|
cooldown:
|
|
default-days: 7
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
web:
|
|
patterns: ['*']
|
|
update-types: [minor, patch]
|
|
web-security:
|
|
applies-to: security-updates
|
|
patterns: ['*']
|
|
# Major bumps are breaking and reviewed deliberately, not auto-PR'd.
|
|
# Security updates ignore this filter, so the Security tab stays clean.
|
|
ignore:
|
|
- dependency-name: '*'
|
|
update-types: ['version-update:semver-major']
|
|
|
|
- package-ecosystem: npm
|
|
directory: /src/McpServer/autopilot-monitor-mcp
|
|
schedule:
|
|
interval: weekly
|
|
cooldown:
|
|
default-days: 7
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
mcp:
|
|
patterns: ['*']
|
|
update-types: [minor, patch]
|
|
mcp-security:
|
|
applies-to: security-updates
|
|
patterns: ['*']
|
|
# Major bumps are breaking and reviewed deliberately, not auto-PR'd.
|
|
# Security updates ignore this filter, so the Security tab stays clean.
|
|
ignore:
|
|
- dependency-name: '*'
|
|
update-types: ['version-update:semver-major']
|
|
|
|
# Validator tooling for rules/ (ajv for validate.js); combine-rules.yml installs it from this
|
|
# lockfile with contents:write in hand, so the pins must not go stale.
|
|
- package-ecosystem: npm
|
|
directory: /rules/scripts
|
|
schedule:
|
|
interval: weekly
|
|
cooldown:
|
|
default-days: 7
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
rules-tooling:
|
|
patterns: ['*']
|
|
rules-tooling-security:
|
|
applies-to: security-updates
|
|
patterns: ['*']
|
|
|
|
# Duplicate-check tooling (jscpd for tools/quality/check-duplicates.mjs), installed by the
|
|
# CI duplicates job from this lockfile. A jscpd update can change the clone fingerprints:
|
|
# if its PR fails the job, regenerate the baseline (npm run dup:baseline) in that PR.
|
|
- package-ecosystem: npm
|
|
directory: /tools/quality
|
|
schedule:
|
|
interval: weekly
|
|
cooldown:
|
|
default-days: 7
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
quality-tooling:
|
|
patterns: ['*']
|
|
quality-tooling-security:
|
|
applies-to: security-updates
|
|
patterns: ['*']
|
|
|
|
# Every action is referenced by commit SHA with the version in a trailing comment;
|
|
# action-pins.yml fails any workflow change that reintroduces a mutable tag. Dependabot
|
|
# is what keeps those pins current: it rewrites the SHA and the comment together, so the
|
|
# pins are reviewed in a PR instead of drifting silently or being bumped by hand.
|
|
- package-ecosystem: github-actions
|
|
directory: /
|
|
schedule:
|
|
interval: monthly
|
|
cooldown:
|
|
default-days: 7
|
|
groups:
|
|
actions:
|
|
patterns: ['*']
|
|
actions-security:
|
|
applies-to: security-updates
|
|
patterns: ['*']
|