Skip to content

ci: Dependabot auto-merge and quality gates - #37

Merged
mokevnin merged 5 commits into
mainfrom
ci/quality-gates
Oct 31, 2026
Merged

mokevnin merged 5 commits into
mainfrom
ci/quality-gates

Conversation

@mokevnin

@mokevnin mokevnin commented Oct 31, 2026 •

Copy link
Copy Markdown
Owner
  • Dependabot PRs get auto-merge (squash) armed; GitHub merges them once the required build and check checks pass (ruleset on main, admins bypass).
  • The Pages workflow builds the book on pull requests (build); deploy stays on main.
  • Applied dev-quality-gates: mise run check runs jactionlint, betterleaks, typos, rumdl, agnix and oxlint (pinned in mise.toml); the new Check workflow runs it plus commitlint over the PR range. OSV-Scanner runs weekly in Audit.
  • Makefile and lefthook replaced with mise tasks; the pre-commit and commit-msg git hooks are mise tasks installed by mise run setup.
  • jactionlint fixes: actions pinned to SHAs, job timeouts, job-scoped permissions, 7-day Dependabot cooldown.
  • rumdl autofixes in Markdown (bare URLs wrapped, no content changes).

After merging, run mise run setup in other clones: their old lefthook hooks point at a removed binary.

🤖 Generated with Claude Code

mokevnin and others added 5 commits October 31, 2026 16:27
Build the book on pull requests so there is a check to wait for, and
keep the Pages deploy and its permissions to pushes on main.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Pin actions to commit SHAs, set job timeouts, scope write permissions to
the jobs that need them, never cancel a running Pages deploy, and add a
7-day Dependabot cooldown.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Wrap bare URLs in angle brackets, tag a code fence, use one emphasis
style. No content changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mise.toml pins jactionlint, betterleaks, typos, rumdl, agnix and
osv-scanner; oxlint is a devDependency. make check runs them all, the
pre-commit hook runs them on staged files, and the Check workflow runs
make check plus commitlint over the PR range. OSV-Scanner runs weekly.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mise.toml is now the single entry point: setup, serve, build, pdf,
check, fix, audit, update and clean are mise tasks, and the pre-commit
and commit-msg git hooks are mise tasks installed by mise run setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@mokevnin
mokevnin merged commit dc29819 into main Oct 31, 2026
4 checks passed
@mokevnin
mokevnin deleted the ci/quality-gates branch October 31, 2026 20:37

This branch was successfully deployed

1 active deployment
github-pages — dc298195 Deployed Oct 31, 2026 by mokevnin via deploy #94
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant