ci: label Dependabot pull requests with the org taxonomy - #83
Merged
Conversation
Promotes the repository baseline (#1): LICENSE (AGPL-3.0), README, dependabot, CI, clippy fixes, clean gitignore.
Brings the `guard` workflow to `main` so it can run on incoming pull requests. First release using the new merge policy (merge commit), which keeps `main` and `develop` history synchronized.
Ships the guard workflow permissions fix to `main`.
Ships the Apache 2.0 relicense to `main`.
Ships the Glyndor copyright attribution to `main`.
Ships the pr-guard workflow to `main`.
Ships the pr-guard removal to `main`; PR creation is now restricted natively.
First standalone release of the agent since the extraction from the
panel monorepo.
- Standalone release pipeline: signed (Ed25519, organization key) and
attested `lynx-agent-linux-{x86_64,arm64}` artifacts on `v*` tags.
- Self-update (fallback updater) and installers now resolve releases
from this repository.
- Compose dependency renamed to `podup`, pinned to its `v0.3.1` release
tag.
- Release verification key rotated to the organization-level signing
key.
Patch release: embeds podup v0.3.2, which carries the inline-secret staging-directory hardening and pre-release audit fixes that v1.3.0 (built against podup v0.3.1) lacked.
Merge develop → main. Picks up podup v0.5.8 pin (#36).
Promotes the podup v0.8.0 pin bump to main. Library API unchanged (cargo check passes).
Promotes podup v0.9.0 pin to main. panel-agent uses Engine::up only; cargo check passes.
Release v1.4.0 — the lynx→helmly-agent brand purge.
Highlights:
- Sources moved to internal/; crate and binary renamed lynx-agent →
helmly-agent.
- Install footprint moved to /etc/glyndor/helmly and
/var/lib/glyndor/helmly; systemd units, system user, DB, pg_tde keyring
and podman objects renamed to helmly-agent.
- nftables table and chains renamed to helmly-* with forward migration
009 for the persisted rows.
- WireGuard interfaces renamed to wg-helmly-*.
- Release assets now publish as helmly-agent-linux-{arch}; self-update
points at Glyndor/helmly-agent.
- Fixed a stale-include cleanup so nft -f never fails after reinstalling
over an old-brand host.
Breaking: existing installs cannot upgrade in place — a reinstall is
required. The dashboard side (Glyndor/helmly#135) is already on develop
and resolves the new asset names.
Hotfix release v1.4.1 — rotate the pinned release verify key to the org key. v1.4.0 published binaries signed by the unified org key while its installer, update script and self-update verifier still pinned the retired key, so a fresh install rejected the signature. v1.4.1 pins the org public key in all three verifiers so the published installer and binaries agree. No other changes.
Jaro-c
added
type:ci
The config asked for "dependencies", which predates the type:/prio:/ effort:/status:/area: taxonomy the rest of this repository uses. Ask for type:deps instead, so a Dependabot pull request filters like everything else. Signed-off-by: Jaro-c <75870284+Jaro-c@users.noreply.github.com>
Jaro-c
force-pushed
the
ci/dependabot-org-labels
branch
from
July 26, 2026 17:01
4b57f70 to
8226777
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Dependabot config asked for a
dependencieslabel, which predates thetype:/prio:/effort:/status:/area:taxonomy the rest of this repository uses. It now asks fortype:deps.Landing on
mainrather than riding a release: Dependabot version updates stopped running here at the end of June, and they only re-register when the config file itself changes on the default branch — measured across the org, confirmed onGlyndor/apt#65.