From e93c5bb4e702f5340ad80a0dfb5c87bdc81970aa Mon Sep 17 00:00:00 2001 From: Dylan Volz Date: Thu, 5 Nov 2026 02:07:59 +0000 Subject: [PATCH 1/3] ci: configure grouped Dependabot security updates and fix Renovate config --- .github/dependabot.yml | 174 +++++++++++++++++++++++++++++++ .github/renovate.json5 | 24 +++-- .github/trusted-contribution.yml | 1 + 3 files changed, 192 insertions(+), 7 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 000000000000..fa52f2ebbdf4 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,174 @@ +# Copyright 2026 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +version: 2 +updates: + # 1. Core Toolbox Go module (group minor/patch CVEs; leave major bumps separate) + - package-ecosystem: "gomod" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 0 + labels: + - "type: process" + commit-message: + prefix: "chore" + include: "scope" + groups: + go-security: + applies-to: security-updates + update-types: + - "minor" + - "patch" + patterns: + - "*" + + # 2. Go Sample modules (single grouped PR across all Go samples under /docs) + - package-ecosystem: "gomod" + directories: + - "/docs/**/*" + schedule: + interval: "weekly" + open-pull-requests-limit: 0 + labels: + - "type: process" + commit-message: + prefix: "chore" + include: "scope" + groups: + go-samples-security: + applies-to: security-updates + patterns: + - "*" + + # 3. Hugo Go modules + - package-ecosystem: "gomod" + directory: "/.hugo" + schedule: + interval: "weekly" + open-pull-requests-limit: 0 + labels: + - "type: process" + commit-message: + prefix: "chore" + include: "scope" + groups: + hugo-go-security: + applies-to: security-updates + patterns: + - "*" + + # 4. JS Sample packages (single grouped PR across all JS samples under /docs) + - package-ecosystem: "npm" + directories: + - "/docs/**/*" + schedule: + interval: "weekly" + open-pull-requests-limit: 0 + labels: + - "type: process" + commit-message: + prefix: "chore" + include: "scope" + groups: + js-samples-security: + applies-to: security-updates + patterns: + - "*" + + # 5. Hugo Node tooling + - package-ecosystem: "npm" + directory: "/.hugo" + schedule: + interval: "weekly" + open-pull-requests-limit: 0 + labels: + - "type: process" + commit-message: + prefix: "chore" + include: "scope" + groups: + hugo-npm-security: + applies-to: security-updates + patterns: + - "*" + + # 6. Python Sample requirements (single grouped PR across all Python samples under /docs) + - package-ecosystem: "pip" + directories: + - "/docs/**/*" + schedule: + interval: "weekly" + open-pull-requests-limit: 0 + labels: + - "type: process" + commit-message: + prefix: "chore" + include: "scope" + groups: + python-samples-security: + applies-to: security-updates + patterns: + - "*" + + # 7. PyPI wrapper package build metadata + - package-ecosystem: "pip" + directory: "/pypi" + schedule: + interval: "weekly" + open-pull-requests-limit: 0 + labels: + - "type: process" + commit-message: + prefix: "chore" + include: "scope" + groups: + pypi-security: + applies-to: security-updates + patterns: + - "*" + + # 8. Container base images + - package-ecosystem: "docker" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 0 + labels: + - "type: process" + commit-message: + prefix: "chore" + include: "scope" + groups: + docker-security: + applies-to: security-updates + patterns: + - "*" + + # 9. GitHub Actions workflows + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 0 + labels: + - "type: process" + commit-message: + prefix: "chore" + include: "scope" + groups: + github-actions-security: + applies-to: security-updates + patterns: + - "*" diff --git a/.github/renovate.json5 b/.github/renovate.json5 index b951ecad7e8d..542a9c8f666b 100644 --- a/.github/renovate.json5 +++ b/.github/renovate.json5 @@ -10,9 +10,18 @@ ], minimumReleaseAge: '3 days', rebaseWhen: 'conflicted', + labels: [ + 'type: process', + ], dependencyDashboardLabels: [ 'type: process', ], + ignorePaths: [ + 'npm/**', + ], + vulnerabilityAlerts: { + enabled: false, + }, postUpdateOptions: [ 'gomodTidy', ], @@ -49,9 +58,9 @@ matchManagers: [ 'gomod', ], - ignorePaths: [ - 'docs/**', - '.hugo/**', + matchFileNames: [ + '!docs/**', + '!.hugo/**', ], }, { @@ -73,8 +82,8 @@ 'minor', 'patch', ], - ignorePaths: [ - 'docs/**', + matchFileNames: [ + '!docs/**', ], }, { @@ -90,10 +99,11 @@ { groupName: 'Pip', matchManagers: [ + 'pep621', 'pip_requirements', ], - ignorePaths: [ - 'docs/**', + matchFileNames: [ + '!docs/**', ], }, { diff --git a/.github/trusted-contribution.yml b/.github/trusted-contribution.yml index 317e890f6bc6..0783000ed106 100644 --- a/.github/trusted-contribution.yml +++ b/.github/trusted-contribution.yml @@ -18,6 +18,7 @@ trustedContributors: - "dependabot[bot]" + - "renovate[bot]" - "renovate-bot" annotations: # Trigger Cloud Build tests From 85860f798c67c12533218cb8a3f11ff6bed176ae Mon Sep 17 00:00:00 2001 From: Dylan Volz Date: Thu, 5 Nov 2026 02:40:47 +0000 Subject: [PATCH 2/3] add cooldowns to all update blocks in dependabot --- .github/dependabot.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index fa52f2ebbdf4..0ff9eb136908 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -19,6 +19,8 @@ updates: directory: "/" schedule: interval: "weekly" + cooldown: + default-days: 7 open-pull-requests-limit: 0 labels: - "type: process" @@ -40,6 +42,8 @@ updates: - "/docs/**/*" schedule: interval: "weekly" + cooldown: + default-days: 7 open-pull-requests-limit: 0 labels: - "type: process" @@ -57,6 +61,8 @@ updates: directory: "/.hugo" schedule: interval: "weekly" + cooldown: + default-days: 7 open-pull-requests-limit: 0 labels: - "type: process" @@ -75,6 +81,8 @@ updates: - "/docs/**/*" schedule: interval: "weekly" + cooldown: + default-days: 7 open-pull-requests-limit: 0 labels: - "type: process" @@ -92,6 +100,8 @@ updates: directory: "/.hugo" schedule: interval: "weekly" + cooldown: + default-days: 7 open-pull-requests-limit: 0 labels: - "type: process" @@ -110,6 +120,8 @@ updates: - "/docs/**/*" schedule: interval: "weekly" + cooldown: + default-days: 7 open-pull-requests-limit: 0 labels: - "type: process" @@ -127,6 +139,8 @@ updates: directory: "/pypi" schedule: interval: "weekly" + cooldown: + default-days: 7 open-pull-requests-limit: 0 labels: - "type: process" @@ -144,6 +158,8 @@ updates: directory: "/" schedule: interval: "weekly" + cooldown: + default-days: 7 open-pull-requests-limit: 0 labels: - "type: process" @@ -161,6 +177,8 @@ updates: directory: "/" schedule: interval: "weekly" + cooldown: + default-days: 7 open-pull-requests-limit: 0 labels: - "type: process" From 32c623bb71988eabb8dfce8c42d0852a2a090a7b Mon Sep 17 00:00:00 2001 From: Dylan Volz Date: Tue, 10 Nov 2026 19:20:18 +0000 Subject: [PATCH 3/3] change chore prefix to fix to trigger release please --- .github/dependabot.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 0ff9eb136908..1f291a257e2c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -25,7 +25,7 @@ updates: labels: - "type: process" commit-message: - prefix: "chore" + prefix: "fix" include: "scope" groups: go-security: @@ -164,7 +164,7 @@ updates: labels: - "type: process" commit-message: - prefix: "chore" + prefix: "fix" include: "scope" groups: docker-security: