mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-11-08 19:12:59 +00:00
Oliver Kieselbach
d26d877989
The SWA CLI lockfile moves from .github/tools/swa-cli to tools/swa-cli: Dependabot's update PR for the old folder was refused. deploy-web and the Dependabot entry follow. Its package.json overrides adm-zip (^0.6.1) and tmp (^0.2.7), which the CLI still pins below the versions that fix their advisories. The CLI's own extract call works on adm-zip 0.6.1, and swa --version and swa deploy --help load. .gitmodules sets update = none for the three private submodules, so recursive clones skip them. Public clones no longer fail on them, and Dependabot's NuGet updater, which clones with --recurse-submodules and aborts on any failure, can run again. A clone with access sets submodule.<name>.update = checkout once. The web postcss override becomes "$postcss": it follows the devDependency that Dependabot bumps instead of conflicting with it. The lockfile is unchanged. zizmor.yml moves to .github/zizmor.yml, where zizmor finds it on its own; CI, CodeQL and the workflow gates watch the new path. Decision D-417. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>