[REFINE:OPS-8.a] Maintainer decides: restore Dependabot or document a manual cadence

[Ranelkin]

Step

ID: OPS-8.a
Source refinement task: OPS-8 Replace dependabot with a documented supply-chain audit cadence
Directory: docs/operations.md or new docs/security.md, optionally .github/dependabot.yml
Execution tier: human

Why this matters for prod

d6904ba also deleted .github/dependabot.yml. Bookie ships pdf-lib, jszip, sqlx, keyring, aws-sdk-s3, tauri-plugin-sql, and now zip 8 — any CVE in this set lands in user binaries that GoBD wants retained for ten years. Dependabot is free even when CI is disabled (it just files PRs that a human reviews), but the user removed the file alongside CI, which suggests the intent was to stop noise rather than to stop monitoring. Without either bot-driven advisories or a documented manual cadence, the next sha2 0.10→0.11-style bump won't surface until something breaks.

What to do

The maintainer decides between (A) restore .github/dependabot.yml with cargo + npm ecosystems, monthly schedule, open-pull-requests-limit: 3 — accepting that Dependabot files PRs without CI, reviewed manually; or (B) commit a docs/security.md documenting a quarterly cadence in which the maintainer runs bun audit --audit-level=high and cargo audit --deny warnings on the first of each quarter and files an issue per advisory. Decision recorded as a one-line comment on this step issue.

Verification

Maintainer comments restore or manual_cadence on the step issue; agent removes human_input label and proceeds to OPS-8.b.

Dependencies

Depends on: none.

Audit

• Step ID: OPS-8.a
• Source task: OPS-8 (see REFINEMENT.md)
• Generated from refinement.decomposition.json on 2026-05-14
• Created by: Sandcastle (production-refinement skill)

[Ranelkin]

Hand-off — maintainer decision needed

This step is execution_tier: human and blocks #229 (OPS-8.b) and #230 (OPS-8.c).

The choice:

• restore — re-author .github/dependabot.yml with cargo (src-tauri) + npm (root) ecosystems, monthly schedule, open-pull-requests-limit: 3, label dependencies. Cost: Dependabot continues to file PRs into a repo with no CI; you triage them by hand. Free to run, but each PR demands attention.
• manual_cadence — author docs/security.md documenting a quarterly cadence: maintainer runs bun audit --audit-level=high and cargo audit --deny warnings on the first of each quarter and files an issue per advisory. Cost: discipline, plus the inherent lag (CVE filed today might wait up to ~3 months for surfacing).

Please reply with a single word: restore or manual_cadence. Once you do, I'll remove the human_input label and proceed to OPS-8.b (#229).

— posted automatically by github-issue-worker