[PR #417] [CLOSED] ci: add dependency audit and Dependabot config #555

New issue

Closed

opened 2026-05-06 13:08:44 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:08:44 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/417
Author: @Divkix
Created: 3/10/2026
Status: ❌ Closed

Base: main ← Head: ci/dependency-scanning

📝 Commits (1)

2d223fe ci: add dependency audit and Dependabot config

📊 Changes

2 files changed (+24 additions, -0 deletions)

View changed files

➕ .github/dependabot.yml (+14 -0)
📝 .github/workflows/ci.yml (+10 -0)

📄 Description

Summary

Add pnpm audit --audit-level high job to CI (advisory, non-blocking via continue-on-error)
Add Dependabot config for npm (weekly, minor+patch grouped) and GitHub Actions (weekly)

Closes #416

Test plan

CI workflow YAML is valid
Dependabot config YAML is valid
New Dependency Audit job appears in CI run
Dependabot starts opening PRs after merge

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/417 **Author:** [@Divkix](https://github.com/Divkix) **Created:** 3/10/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `ci/dependency-scanning` --- ### 📝 Commits (1) - [`2d223fe`](https://github.com/cloudflare/vinext/commit/2d223fecf062db1b996f79dee7402739201c6e70) ci: add dependency audit and Dependabot config ### 📊 Changes **2 files changed** (+24 additions, -0 deletions) <details> <summary>View changed files</summary> ➕ `.github/dependabot.yml` (+14 -0) 📝 `.github/workflows/ci.yml` (+10 -0) </details> ### 📄 Description ## Summary - Add `pnpm audit --audit-level high` job to CI (advisory, non-blocking via `continue-on-error`) - Add Dependabot config for npm (weekly, minor+patch grouped) and GitHub Actions (weekly) Closes #416 ## Test plan - [ ] CI workflow YAML is valid - [ ] Dependabot config YAML is valid - [ ] New `Dependency Audit` job appears in CI run - [ ] Dependabot starts opening PRs after merge --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>