Skip to content

ci: trigger patch release for Dependabot security updates - #408

Merged
steoj merged 1 commit into
mainfrom
feat/dependabot-security-patch-release
Jul 23, 2026
Merged

ci: trigger patch release for Dependabot security updates#408
steoj merged 1 commit into
mainfrom
feat/dependabot-security-patch-release

Conversation

@steoj

@steoj steoj commented Jul 23, 2026

Copy link
Copy Markdown
Collaborator

What

Adds .github/workflows/dependabot-security-fix.yml, which retitles Dependabot security PRs to a fix(deps): ... Conventional Commit.

Why

Releases are driven by release-please (release-type: simple), which only bumps a version for fix: (patch), feat: (minor), or breaking changes. Dependabot opens PRs as build(deps): ..., which is release-neutral — so vulnerability fixes currently merge without producing a release.

How

  • Runs on Dependabot PRs (pull_request_target, gated to dependabot[bot]).
  • dependabot/fetch-metadata (pinned to SHA, v3.1.0) reads the update metadata.
  • Only when the update resolves a security advisory (ghsa-id present) it rewrites the PR title to fix(deps): … [security GHSA-…] and adds a security label.
  • On squash-merge, that yields a fix: commit on main, so release-please opens/updates a patch-level release PR (release candidate). Routine, non-security updates keep build(deps) and stay release-neutral.

Notes / safety

  • pull_request_target is required so the token can edit the PR title (Dependabot pull_request runs are read-only). The workflow never checks out PR code and passes the PR title via an env var (no inline interpolation in shell), avoiding script injection.
  • Relies on squash-merging Dependabot PRs (squash subject defaults to the PR title).

Validation

  • actionlint: pass · Prettier (CI 3.8.4): pass · yaml-lint line-length is warning-only.

@github-actions

github-actions Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Test Coverage

Vitest Coverage (summary)

Lines Statements Branches Functions
Coverage: 100%
 100% (273/273) 98.29% (115/117) 100% (58/58)
Coverage Report (100%)
File% Stmts% Branch% Funcs% LinesUncovered Line #s
All files10098.29100100 
src10098.29100100 
   ...ailureRate.ts100100100100 
   ...itsAdapter.ts100100100100 
   ...yFrequency.ts10090.910010023
   IssuesAdapter.ts100100100100 
   LeadTime.ts10096.5510010059
   ...eToRestore.ts100100100100 
   ...stsAdapter.ts100100100100 
   ...aseAdapter.ts100100100100 
   index.ts100100100100 
src/interfaces0000 
   ...itsAdapter.ts0000 
   ...uesAdapter.ts0000 
   ...stsAdapter.ts0000 
   ...aseAdapter.ts0000 
src/types0000 
   Commit.ts0000 
   Issue.ts0000 
   Person.ts0000 
   PullRequest.ts0000 
   Release.ts0000 

@github-actions

github-actions Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Code Coverage change
This PR changes coverage by 0 %
Component coverage will change from 100% to 100%.

@github-actions

github-actions Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Stryker report

File % score # killed # timeout # survived # no cov # errors
DeployFrequency.ts 93.10 27 0 2 0 12
LeadTime.ts 67.05 59 0 29 0 17
MeanTimeToRestore.ts 86.54 90 0 14 0 24
ChangeFailureRate.ts 87.36 76 0 11 0 11
CommitsAdapter.ts 100.00 5 0 0 0 4
IssuesAdapter.ts 45.00 9 0 11 0 6
PullRequestsAdapter.ts 45.00 9 0 11 0 6
ReleaseAdapter.ts 45.00 9 0 11 0 6
index.ts 69.77 60 0 26 0 3
All 74.95 344 0 115 0 89

github-actions Bot pushed a commit that referenced this pull request Jul 23, 2026
Deploy mutation report for PR #408
eb4f2c5
@steoj
steoj merged commit 8366f50 into main Jul 23, 2026
35 checks passed
@steoj
steoj deleted the feat/dependabot-security-patch-release branch July 23, 2026 10:28
@github-actions

github-actions Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Stryker report

File % score # killed # timeout # survived # no cov # errors
DeployFrequency.ts 93.10 27 0 2 0 12
LeadTime.ts 67.05 59 0 29 0 17
MeanTimeToRestore.ts 86.54 90 0 14 0 24
ChangeFailureRate.ts 87.36 76 0 11 0 11
IssuesAdapter.ts 45.00 9 0 11 0 6
PullRequestsAdapter.ts 45.00 9 0 11 0 6
ReleaseAdapter.ts 45.00 9 0 11 0 6
CommitsAdapter.ts 100.00 5 0 0 0 4
index.ts 69.77 60 0 26 0 3
All 74.95 344 0 115 0 89

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@steoj @stenjo