chore: add dependabot.yml + SHA-pin all GitHub Actions#728
Open
cailmdaley wants to merge 2 commits into
Open
Conversation
Adds an explicit version-updates policy on top of the security-updates channel that fires automatically since uv.lock landed (#719). Posture is supply-chain conservative: - 14-day cooldown on minor/patch, 30-day on majors (Dependabot won't PR a version until it's been live for that long). Buys a detection window against maintainer-compromise attacks (Shai-Hulud, axios, PyTorch Lightning, …) where malicious versions typically get yanked within hours-to-days. - Monthly schedule + grouped patch/minor — one batched PR, atomic to revert, large enough to actually be reviewed instead of waved through. - Major bumps stay individual (potentially breaking, deserve individual review). - No auto-merge. - github-actions ecosystem also enabled (companion to SHA-pinning the workflows). Cooldown does NOT apply to security updates — those still fire on the CVE-publication timeline, which is the right tradeoff. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Mutable action references (@v4, @V3, …) are the same failure mode that took out tj-actions/changed-files (23k+ repos compromised in Q1 2026) and trivy-action. An attacker who compromises an action's maintainer account can silently re-point a tag at a malicious SHA, and every workflow that references that tag pulls the new code on the next run. Pinning each action by full commit SHA — with the human-readable tag preserved as a trailing comment — closes that vector. Dependabot's github-actions ecosystem (enabled in the companion commit) proposes SHA bumps with the new tag annotated in the PR body, so updates remain reviewable. All four workflows pinned; SHAs resolved against current refs as of this commit, no behavioral change intended. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two related supply-chain-conservative hygiene changes for the post-
uv.lockera:.github/dependabot.yml— explicit version-updates policy with 14-day cooldown on minor/patch (30 days on majors), monthly grouped lockfile PRs, and github-actions ecosystem opted in. Companion to the security-updates channel that fires automatically sinceuv.locklanded (chore: switch Dockerfile to slim Python + uv lockfile #719).No behavioral change intended; SHAs resolved against current refs of the same tags that were referenced before.
Why now
Six dependabot security PRs accumulated against
uv.lockbetween 2026-05-05 and now (being triaged separately). That backlog made the absence of a dependabot.yml visible. While digging in, two things sharpened the posture:@v4-style tags at malicious SHAs. SHA-pinning closes that vector at the cost of less-readable workflow files; the trailing tag comment + Dependabot's SHA-bump PRs keep it tractable.Policy summary
Test plan
build-and-push-imageshould be unaffected — same actions, just SHA-pinned).— Claude on behalf of Cail