From 394eeeef8f2bb4e0a127f37a1603c654a98c5667 Mon Sep 17 00:00:00 2001 From: Spencer Koch Date: Fri, 10 Jul 2026 09:42:14 -0500 Subject: [PATCH 1/4] chore: configure Dependabot updates --- .github/dependabot.yml | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..0aa0fff --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,32 @@ +version: 2 + +updates: + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + time: "11:00" + timezone: "America/Los_Angeles" + cooldown: + default-days: 7 + groups: + security-vulnerabilities-npm: + applies-to: "security-updates" + patterns: + - "*" + + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + time: "11:00" + timezone: "America/Los_Angeles" + cooldown: + default-days: 7 + groups: + security-vulnerabilities-github-actions: + applies-to: "security-updates" + patterns: + - "*" From 2c02fd73697df3b7103bedd97236f266a6de36ed Mon Sep 17 00:00:00 2001 From: Spencer Koch Date: Fri, 10 Jul 2026 09:48:53 -0500 Subject: [PATCH 2/4] docs: add Dependabot trial design --- .../plans/2026-07-10-dependabot-trial.md | 126 ++++++++++++++++++ .../2026-07-10-dependabot-trial-design.md | 45 +++++++ 2 files changed, 171 insertions(+) create mode 100644 docs/superpowers/plans/2026-07-10-dependabot-trial.md create mode 100644 docs/superpowers/specs/2026-07-10-dependabot-trial-design.md diff --git a/docs/superpowers/plans/2026-07-10-dependabot-trial.md b/docs/superpowers/plans/2026-07-10-dependabot-trial.md new file mode 100644 index 0000000..7756744 --- /dev/null +++ b/docs/superpowers/plans/2026-07-10-dependabot-trial.md @@ -0,0 +1,126 @@ +# Dependabot Trial Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Configure Dependabot for Devvit MCP's npm dependencies and GitHub +Actions, delaying ordinary version updates for seven days while retaining +immediate, identifiable security updates. + +**Architecture:** A single repository-local `.github/dependabot.yml` defines +one update block for each detected ecosystem. Each block contains the same +weekly Pacific-time schedule, a seven-day version-update cooldown, and a +security-only group whose identifier appears in Dependabot's grouped pull +request title and branch. + +**Tech Stack:** Dependabot configuration v2, YAML, Ruby's built-in `yaml` +parser for local structural validation. + +--- + +### Task 1: Add the Dependabot policy and validate its contract + +**Files:** +- Create: `.github/dependabot.yml` +- Test: inline Ruby YAML contract run from the repository root + +- [ ] **Step 1: Run the configuration contract before the file exists** + +Run: + +```bash +ruby -e 'require "yaml"; config = YAML.load_file(".github/dependabot.yml"); expected = { "npm" => "security-vulnerabilities-npm", "github-actions" => "security-vulnerabilities-github-actions" }; abort "expected version 2" unless config["version"] == 2; expected.each { |ecosystem, group| update = config.fetch("updates").find { |entry| entry["package-ecosystem"] == ecosystem }; abort "missing #{ecosystem}" unless update; abort "wrong directory for #{ecosystem}" unless update["directory"] == "/"; schedule = update.fetch("schedule"); abort "wrong schedule for #{ecosystem}" unless schedule == { "interval" => "weekly", "day" => "monday", "time" => "11:00", "timezone" => "America/Los_Angeles" }; abort "wrong cooldown for #{ecosystem}" unless update.fetch("cooldown") == { "default-days" => 7 }; security = update.fetch("groups").fetch(group); abort "wrong security group for #{ecosystem}" unless security == { "applies-to" => "security-updates", "patterns" => ["*"] } }' +``` + +Expected: fail with `Errno::ENOENT` because `.github/dependabot.yml` does not +yet exist. + +- [ ] **Step 2: Create `.github/dependabot.yml`** + +```yaml +version: 2 + +updates: + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + time: "11:00" + timezone: "America/Los_Angeles" + cooldown: + default-days: 7 + groups: + security-vulnerabilities-npm: + applies-to: "security-updates" + patterns: + - "*" + + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + time: "11:00" + timezone: "America/Los_Angeles" + cooldown: + default-days: 7 + groups: + security-vulnerabilities-github-actions: + applies-to: "security-updates" + patterns: + - "*" +``` + +- [ ] **Step 3: Run the configuration contract after adding the file** + +Run: + +```bash +ruby -e 'require "yaml"; config = YAML.load_file(".github/dependabot.yml"); expected = { "npm" => "security-vulnerabilities-npm", "github-actions" => "security-vulnerabilities-github-actions" }; abort "expected version 2" unless config["version"] == 2; expected.each { |ecosystem, group| update = config.fetch("updates").find { |entry| entry["package-ecosystem"] == ecosystem }; abort "missing #{ecosystem}" unless update; abort "wrong directory for #{ecosystem}" unless update["directory"] == "/"; schedule = update.fetch("schedule"); abort "wrong schedule for #{ecosystem}" unless schedule == { "interval" => "weekly", "day" => "monday", "time" => "11:00", "timezone" => "America/Los_Angeles" }; abort "wrong cooldown for #{ecosystem}" unless update.fetch("cooldown") == { "default-days" => 7 }; security = update.fetch("groups").fetch(group); abort "wrong security group for #{ecosystem}" unless security == { "applies-to" => "security-updates", "patterns" => ["*"] } }' +``` + +Expected: exit 0 with no output. + +- [ ] **Step 4: Check YAML formatting and the scoped diff** + +Run: + +```bash +git diff --check && git diff -- .github/dependabot.yml +``` + +Expected: exit 0; the diff contains only the intended Dependabot policy. + +- [ ] **Step 5: Commit the policy** + +```bash +git add .github/dependabot.yml +git commit -m "chore: configure Dependabot updates" +``` + +Expected: Git reports one new Dependabot configuration file committed. + +### Task 2: Confirm GitHub acceptance after push + +**Files:** +- Modify: none +- Test: GitHub Dependabot status for this repository + +- [ ] **Step 1: Push the policy commit through the normal repository workflow** + +Run: + +```bash +git push +``` + +Expected: the remote branch receives the Dependabot policy. + +- [ ] **Step 2: Review Dependabot's repository status** + +Open the repository's **Insights → Dependency graph → Dependabot** view after +GitHub has processed the configuration. + +Expected: both npm and GitHub Actions are configured without a configuration +error. Version updates honor the cooldown; security updates remain +alert-triggered and use the security-only group identifiers when grouped. diff --git a/docs/superpowers/specs/2026-07-10-dependabot-trial-design.md b/docs/superpowers/specs/2026-07-10-dependabot-trial-design.md new file mode 100644 index 0000000..100841d --- /dev/null +++ b/docs/superpowers/specs/2026-07-10-dependabot-trial-design.md @@ -0,0 +1,45 @@ +# Dependabot Trial Design + +## Goal + +Add a repository-local Dependabot configuration for Devvit MCP that keeps npm +dependencies and GitHub Actions current while delaying ordinary releases for +seven days and making security-update pull requests easy to distinguish. + +## Scope + +- Create `.github/dependabot.yml` on the default branch. +- Configure the `npm` ecosystem at the repository root. +- Configure the `github-actions` ecosystem at the repository root. +- Run ordinary version-update checks weekly on Monday at 11:00 in + `America/Los_Angeles`, matching the existing Renovate schedule as closely as + Dependabot permits. +- Apply a seven-day cooldown to ordinary version updates in each ecosystem. +- Add one security-only group per ecosystem: `security-vulnerabilities-npm` + and `security-vulnerabilities-github-actions`. + +## Behavior + +Dependabot will defer an ordinary candidate release until it is at least seven +days old. Dependabot security updates are intentionally not subject to the +cooldown and remain alert-triggered. The security group identifiers make the +corresponding security pull request title and branch distinguishable from +ordinary version-update pull requests. + +No custom labels are included: Dependabot cannot apply labels only to security +updates. A separate PR-triage automation would be required for an exact +`security` label and is outside this trial. + +## Verification + +Parse the file as YAML locally and inspect the final configuration for both +ecosystems, their seven-day cooldowns, and their security-only groups. GitHub +will perform authoritative Dependabot validation when it reads the file after +it is pushed. + +## Out of Scope + +- Organization-wide rollout or synchronization. +- A GitHub App or Action that applies security-only labels. +- Routine version-update grouping beyond Dependabot's default per-dependency + pull requests. From 24652ded7ba93830e56bdce47bf3fdfadb4f19af Mon Sep 17 00:00:00 2001 From: Spencer Koch Date: Fri, 10 Jul 2026 09:53:22 -0500 Subject: [PATCH 3/4] style: format Dependabot configuration --- .github/dependabot.yml | 32 ++--- .../plans/2026-07-10-dependabot-trial.md | 126 ------------------ .../2026-07-10-dependabot-trial-design.md | 45 ------- 3 files changed, 16 insertions(+), 187 deletions(-) delete mode 100644 docs/superpowers/plans/2026-07-10-dependabot-trial.md delete mode 100644 docs/superpowers/specs/2026-07-10-dependabot-trial-design.md diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 0aa0fff..c0cb3d1 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,32 +1,32 @@ version: 2 updates: - - package-ecosystem: "npm" - directory: "/" + - package-ecosystem: 'npm' + directory: '/' schedule: - interval: "weekly" - day: "monday" - time: "11:00" - timezone: "America/Los_Angeles" + interval: 'weekly' + day: 'monday' + time: '11:00' + timezone: 'America/Los_Angeles' cooldown: default-days: 7 groups: security-vulnerabilities-npm: - applies-to: "security-updates" + applies-to: 'security-updates' patterns: - - "*" + - '*' - - package-ecosystem: "github-actions" - directory: "/" + - package-ecosystem: 'github-actions' + directory: '/' schedule: - interval: "weekly" - day: "monday" - time: "11:00" - timezone: "America/Los_Angeles" + interval: 'weekly' + day: 'monday' + time: '11:00' + timezone: 'America/Los_Angeles' cooldown: default-days: 7 groups: security-vulnerabilities-github-actions: - applies-to: "security-updates" + applies-to: 'security-updates' patterns: - - "*" + - '*' diff --git a/docs/superpowers/plans/2026-07-10-dependabot-trial.md b/docs/superpowers/plans/2026-07-10-dependabot-trial.md deleted file mode 100644 index 7756744..0000000 --- a/docs/superpowers/plans/2026-07-10-dependabot-trial.md +++ /dev/null @@ -1,126 +0,0 @@ -# Dependabot Trial Implementation Plan - -> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. - -**Goal:** Configure Dependabot for Devvit MCP's npm dependencies and GitHub -Actions, delaying ordinary version updates for seven days while retaining -immediate, identifiable security updates. - -**Architecture:** A single repository-local `.github/dependabot.yml` defines -one update block for each detected ecosystem. Each block contains the same -weekly Pacific-time schedule, a seven-day version-update cooldown, and a -security-only group whose identifier appears in Dependabot's grouped pull -request title and branch. - -**Tech Stack:** Dependabot configuration v2, YAML, Ruby's built-in `yaml` -parser for local structural validation. - ---- - -### Task 1: Add the Dependabot policy and validate its contract - -**Files:** -- Create: `.github/dependabot.yml` -- Test: inline Ruby YAML contract run from the repository root - -- [ ] **Step 1: Run the configuration contract before the file exists** - -Run: - -```bash -ruby -e 'require "yaml"; config = YAML.load_file(".github/dependabot.yml"); expected = { "npm" => "security-vulnerabilities-npm", "github-actions" => "security-vulnerabilities-github-actions" }; abort "expected version 2" unless config["version"] == 2; expected.each { |ecosystem, group| update = config.fetch("updates").find { |entry| entry["package-ecosystem"] == ecosystem }; abort "missing #{ecosystem}" unless update; abort "wrong directory for #{ecosystem}" unless update["directory"] == "/"; schedule = update.fetch("schedule"); abort "wrong schedule for #{ecosystem}" unless schedule == { "interval" => "weekly", "day" => "monday", "time" => "11:00", "timezone" => "America/Los_Angeles" }; abort "wrong cooldown for #{ecosystem}" unless update.fetch("cooldown") == { "default-days" => 7 }; security = update.fetch("groups").fetch(group); abort "wrong security group for #{ecosystem}" unless security == { "applies-to" => "security-updates", "patterns" => ["*"] } }' -``` - -Expected: fail with `Errno::ENOENT` because `.github/dependabot.yml` does not -yet exist. - -- [ ] **Step 2: Create `.github/dependabot.yml`** - -```yaml -version: 2 - -updates: - - package-ecosystem: "npm" - directory: "/" - schedule: - interval: "weekly" - day: "monday" - time: "11:00" - timezone: "America/Los_Angeles" - cooldown: - default-days: 7 - groups: - security-vulnerabilities-npm: - applies-to: "security-updates" - patterns: - - "*" - - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - day: "monday" - time: "11:00" - timezone: "America/Los_Angeles" - cooldown: - default-days: 7 - groups: - security-vulnerabilities-github-actions: - applies-to: "security-updates" - patterns: - - "*" -``` - -- [ ] **Step 3: Run the configuration contract after adding the file** - -Run: - -```bash -ruby -e 'require "yaml"; config = YAML.load_file(".github/dependabot.yml"); expected = { "npm" => "security-vulnerabilities-npm", "github-actions" => "security-vulnerabilities-github-actions" }; abort "expected version 2" unless config["version"] == 2; expected.each { |ecosystem, group| update = config.fetch("updates").find { |entry| entry["package-ecosystem"] == ecosystem }; abort "missing #{ecosystem}" unless update; abort "wrong directory for #{ecosystem}" unless update["directory"] == "/"; schedule = update.fetch("schedule"); abort "wrong schedule for #{ecosystem}" unless schedule == { "interval" => "weekly", "day" => "monday", "time" => "11:00", "timezone" => "America/Los_Angeles" }; abort "wrong cooldown for #{ecosystem}" unless update.fetch("cooldown") == { "default-days" => 7 }; security = update.fetch("groups").fetch(group); abort "wrong security group for #{ecosystem}" unless security == { "applies-to" => "security-updates", "patterns" => ["*"] } }' -``` - -Expected: exit 0 with no output. - -- [ ] **Step 4: Check YAML formatting and the scoped diff** - -Run: - -```bash -git diff --check && git diff -- .github/dependabot.yml -``` - -Expected: exit 0; the diff contains only the intended Dependabot policy. - -- [ ] **Step 5: Commit the policy** - -```bash -git add .github/dependabot.yml -git commit -m "chore: configure Dependabot updates" -``` - -Expected: Git reports one new Dependabot configuration file committed. - -### Task 2: Confirm GitHub acceptance after push - -**Files:** -- Modify: none -- Test: GitHub Dependabot status for this repository - -- [ ] **Step 1: Push the policy commit through the normal repository workflow** - -Run: - -```bash -git push -``` - -Expected: the remote branch receives the Dependabot policy. - -- [ ] **Step 2: Review Dependabot's repository status** - -Open the repository's **Insights → Dependency graph → Dependabot** view after -GitHub has processed the configuration. - -Expected: both npm and GitHub Actions are configured without a configuration -error. Version updates honor the cooldown; security updates remain -alert-triggered and use the security-only group identifiers when grouped. diff --git a/docs/superpowers/specs/2026-07-10-dependabot-trial-design.md b/docs/superpowers/specs/2026-07-10-dependabot-trial-design.md deleted file mode 100644 index 100841d..0000000 --- a/docs/superpowers/specs/2026-07-10-dependabot-trial-design.md +++ /dev/null @@ -1,45 +0,0 @@ -# Dependabot Trial Design - -## Goal - -Add a repository-local Dependabot configuration for Devvit MCP that keeps npm -dependencies and GitHub Actions current while delaying ordinary releases for -seven days and making security-update pull requests easy to distinguish. - -## Scope - -- Create `.github/dependabot.yml` on the default branch. -- Configure the `npm` ecosystem at the repository root. -- Configure the `github-actions` ecosystem at the repository root. -- Run ordinary version-update checks weekly on Monday at 11:00 in - `America/Los_Angeles`, matching the existing Renovate schedule as closely as - Dependabot permits. -- Apply a seven-day cooldown to ordinary version updates in each ecosystem. -- Add one security-only group per ecosystem: `security-vulnerabilities-npm` - and `security-vulnerabilities-github-actions`. - -## Behavior - -Dependabot will defer an ordinary candidate release until it is at least seven -days old. Dependabot security updates are intentionally not subject to the -cooldown and remain alert-triggered. The security group identifiers make the -corresponding security pull request title and branch distinguishable from -ordinary version-update pull requests. - -No custom labels are included: Dependabot cannot apply labels only to security -updates. A separate PR-triage automation would be required for an exact -`security` label and is outside this trial. - -## Verification - -Parse the file as YAML locally and inspect the final configuration for both -ecosystems, their seven-day cooldowns, and their security-only groups. GitHub -will perform authoritative Dependabot validation when it reads the file after -it is pushed. - -## Out of Scope - -- Organization-wide rollout or synchronization. -- A GitHub App or Action that applies security-only labels. -- Routine version-update grouping beyond Dependabot's default per-dependency - pull requests. From 43beb857a1fc2c6ddd6cc80dc24c52c3cf7acd1d Mon Sep 17 00:00:00 2001 From: Spencer Koch Date: Fri, 10 Jul 2026 10:16:37 -0500 Subject: [PATCH 4/4] chore: keep major security updates separate --- .github/dependabot.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index c0cb3d1..9b4f1ec 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -13,6 +13,9 @@ updates: groups: security-vulnerabilities-npm: applies-to: 'security-updates' + update-types: + - 'minor' + - 'patch' patterns: - '*'