From 23c83eab011292a6e901031f8b796850f004e3c2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 22 Jun 2026 07:35:55 +0000 Subject: [PATCH 1/2] build(deps): Bump nixpkgs from `a037402` to `e8210c6` in the flake group Bumps the flake group with 1 update: [nixpkgs](https://github.com/NixOS/nixpkgs). Updates `nixpkgs` from `a037402` to `e8210c6` - [Commits](https://github.com/NixOS/nixpkgs/compare/a0374025a863d007d98e3297f6aa46cc3141c2f0...e8210c649915deed7080033cdbabcc19e40bb899) --- updated-dependencies: - dependency-name: nixpkgs dependency-version: e8210c649915deed7080033cdbabcc19e40bb899 dependency-type: direct:production dependency-group: flake ... Signed-off-by: dependabot[bot] --- flake.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/flake.lock b/flake.lock index aa10abf..4834937 100644 --- a/flake.lock +++ b/flake.lock @@ -2,11 +2,11 @@ "nodes": { "nixpkgs": { "locked": { - "lastModified": 1781216227, - "narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=", + "lastModified": 1781808408, + "narHash": "sha256-0sOb6OIaD/K1zHxBhpmlKvkADfe0n8+l4Jj2e1Q0r3w=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0", + "rev": "e8210c649915deed7080033cdbabcc19e40bb899", "type": "github" }, "original": { From a5152bedcc14be42e9014d033b376eed9b6a3ce8 Mon Sep 17 00:00:00 2001 From: D3strukt0r Date: Tue, 23 Jun 2026 13:44:45 +0200 Subject: [PATCH 2/2] fix(ci): group dependabot updates by ecosystem and harden release flow Move CODEOWNERS into .github/ and grant @Team-MaRo/CI ownership of Dependabot-managed paths (cargo, github-actions, nix, devcontainers) so the bot's auto-approval satisfies code-owner review. Add devcontainers ecosystem with a common-utils feature plus its generated devcontainer-lock.json, and add a devcontainers update group. Move release-please config and manifest into .github/ and point the action at them via config-file/manifest-file. Skip the greetings job for dependabot[bot], and approve PRs with GH_PAT so the approval counts toward code-owner review. --- .devcontainer/devcontainer-lock.json | 9 +++++++ .devcontainer/devcontainer.json | 6 +++++ .github/CODEOWNERS | 18 +++++++++++++ .github/dependabot.yml | 27 ++++++++++++++----- .../release-please-config.json | 0 .../release-please-manifest.json | 0 .github/workflows/dependabot-automerge.yml | 2 +- .github/workflows/greetings.yml | 1 + .github/workflows/release.yml | 4 +-- AGENTS.md | 2 +- CODEOWNERS | 4 --- 11 files changed, 59 insertions(+), 14 deletions(-) create mode 100644 .devcontainer/devcontainer-lock.json create mode 100644 .github/CODEOWNERS rename release-please-config.json => .github/release-please-config.json (100%) rename .release-please-manifest.json => .github/release-please-manifest.json (100%) delete mode 100644 CODEOWNERS diff --git a/.devcontainer/devcontainer-lock.json b/.devcontainer/devcontainer-lock.json new file mode 100644 index 0000000..b6f196a --- /dev/null +++ b/.devcontainer/devcontainer-lock.json @@ -0,0 +1,9 @@ +{ + "features": { + "ghcr.io/devcontainers/features/common-utils:2": { + "version": "2.5.9", + "resolved": "ghcr.io/devcontainers/features/common-utils@sha256:cb0c4d3c276f157eed17935747e364178d75fee17f55c4e129966f64633deb3a", + "integrity": "sha256:cb0c4d3c276f157eed17935747e364178d75fee17f55c4e129966f64633deb3a" + } + } +} diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json index b12f051..e99b2f1 100644 --- a/.devcontainer/devcontainer.json +++ b/.devcontainer/devcontainer.json @@ -5,6 +5,12 @@ // develop it here and rust-analyzer/cargo target x86_64-unknown-linux-gnu. "image": "mcr.microsoft.com/devcontainers/rust:1-bookworm", + "features": { + "ghcr.io/devcontainers/features/common-utils:2": { + "configureZshAsDefaultShell": true + } + }, + // Pre-fetch crate deps so the first rust-analyzer/cargo run is fast. "postCreateCommand": "cargo fetch", diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..7699c02 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,18 @@ +# https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners +# Last matching pattern wins. Only ONE listed owner needs to approve, not all. + +# Default owner for everything. +* @D3strukt0r + +# Files Dependabot manages — @Team-MaRo/CI (incl. the bot user) can also review, +# so the bot's auto-approval satisfies the code-owner requirement on these paths. +# cargo +/Cargo.toml @D3strukt0r @Team-MaRo/CI +/Cargo.lock @D3strukt0r @Team-MaRo/CI +# github-actions +/.github/workflows/ @D3strukt0r @Team-MaRo/CI +# nix +/flake.nix @D3strukt0r @Team-MaRo/CI +/flake.lock @D3strukt0r @Team-MaRo/CI +# devcontainers +/.devcontainer/ @D3strukt0r @Team-MaRo/CI diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 31bf874..04d131e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -14,7 +14,7 @@ updates: - "dependabot :robot:" schedule: interval: weekly - day: monday # required: weekly does NOT default to Monday (GitHub keeps a random slot — here Saturday). Do not remove. + day: monday time: '09:30' timezone: Europe/Zurich groups: @@ -22,7 +22,7 @@ updates: patterns: - "*" - - package-ecosystem: cargo + - package-ecosystem: devcontainers directory: / target-branch: develop labels: @@ -33,10 +33,9 @@ updates: time: '09:30' timezone: Europe/Zurich groups: - cargo-minor-patch: - update-types: - - minor - - patch + devcontainers: + patterns: + - "*" - package-ecosystem: nix directory: / @@ -54,3 +53,19 @@ updates: flake: patterns: - "*" + + - package-ecosystem: cargo + directory: / + target-branch: develop + labels: + - "dependabot :robot:" + schedule: + interval: weekly + day: monday + time: '09:30' + timezone: Europe/Zurich + groups: + cargo-non-breaking: + update-types: + - minor + - patch diff --git a/release-please-config.json b/.github/release-please-config.json similarity index 100% rename from release-please-config.json rename to .github/release-please-config.json diff --git a/.release-please-manifest.json b/.github/release-please-manifest.json similarity index 100% rename from .release-please-manifest.json rename to .github/release-please-manifest.json diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 2585ff2..417a67b 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -29,7 +29,7 @@ jobs: if: steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch' env: PR_URL: ${{ github.event.pull_request.html_url }} - GITHUB_TOKEN: ${{ github.token }} + GITHUB_TOKEN: ${{ secrets.GH_PAT }} run: | gh pr checkout "$PR_URL" # sets the upstream metadata for `gh pr status` if [ "$(gh pr status --json reviewDecision -q .currentBranch.reviewDecision)" != "APPROVED" ]; then diff --git a/.github/workflows/greetings.yml b/.github/workflows/greetings.yml index 1ffdfa8..666b188 100644 --- a/.github/workflows/greetings.yml +++ b/.github/workflows/greetings.yml @@ -16,6 +16,7 @@ jobs: greeting: name: Greet First-Time Contributors runs-on: ubuntu-latest + if: github.actor != 'dependabot[bot]' steps: - name: Greet First-Time Contributors diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 925e8a2..70faf28 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,8 +7,6 @@ name: Release # on merge cuts a GitHub Release + git tag. The tag push fires build.yml (which # triggers on `tags: ['*.*.*']`) to build the per-arch binaries and attach them # to the release. -# -# Config: release-please-config.json + .release-please-manifest.json. on: push: @@ -31,6 +29,8 @@ jobs: id: release uses: googleapis/release-please-action@v5 with: + config-file: .github/release-please-config.json + manifest-file: .github/release-please-manifest.json # PAT instead of GITHUB_TOKEN: GitHub suppresses workflow triggers for # tags created via GITHUB_TOKEN, which would prevent build.yml from # firing on the release tag to attach the binaries. diff --git a/AGENTS.md b/AGENTS.md index e3c3342..f98e7e6 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -96,7 +96,7 @@ releases attach: ## Releases Conventional commits → release-please (`release-type: rust`, configured in -`release-please-config.json` + `.release-please-manifest.json`) opens a release PR +`.github/release-please-config.json` + `.github/release-please-manifest.json`) opens a release PR bumping `Cargo.toml`/`Cargo.lock` and `flake.nix` (the `x-release-please-version` marker). Merging cuts a tag + GitHub Release; the tag fires `build.yml` to attach the binaries. Needs the `GH_PAT` secret and "Allow Actions to create PRs". diff --git a/CODEOWNERS b/CODEOWNERS deleted file mode 100644 index 240fb51..0000000 --- a/CODEOWNERS +++ /dev/null @@ -1,4 +0,0 @@ -# https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners - -# These owners will be the default owners for everything in the repo. -* @D3strukt0r