deps(deps): bump golang.org/x/crypto from 0.52.0 to 0.54.0 #153
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Supply-chain hardening: hold Dependabot PRs for 14 days before approving. | |
| # This quarantine window lets the community detect compromised releases | |
| # before they land in our dependency tree. | |
| name: Dependabot Quarantine | |
| on: | |
| pull_request_target: | |
| types: [opened] | |
| schedule: | |
| # Re-evaluate pending PRs daily at 06:00 UTC. | |
| - cron: "0 6 * * *" | |
| permissions: | |
| pull-requests: write | |
| contents: read | |
| jobs: | |
| label-new-pr: | |
| if: github.event_name == 'pull_request_target' && github.actor == 'dependabot[bot]' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Add quarantine label | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| script: | | |
| await github.rest.issues.addLabels({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: context.payload.pull_request.number, | |
| labels: ['quarantine:14d'] | |
| }); | |
| approve-aged-prs: | |
| if: github.event_name == 'schedule' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Approve PRs older than 14 days | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| script: | | |
| const QUARANTINE_DAYS = 14; | |
| const cutoff = new Date(); | |
| cutoff.setDate(cutoff.getDate() - QUARANTINE_DAYS); | |
| const pulls = await github.rest.pulls.list({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| state: 'open', | |
| sort: 'created', | |
| direction: 'asc', | |
| per_page: 50, | |
| }); | |
| for (const pr of pulls.data) { | |
| if (pr.user.login !== 'dependabot[bot]') continue; | |
| const created = new Date(pr.created_at); | |
| if (created > cutoff) continue; | |
| // Check if still labelled | |
| const labels = pr.labels.map(l => l.name); | |
| if (!labels.includes('quarantine:14d')) continue; | |
| // Remove quarantine label | |
| await github.rest.issues.removeLabel({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: pr.number, | |
| name: 'quarantine:14d', | |
| }).catch(() => {}); | |
| // Approve the PR | |
| await github.rest.pulls.createReview({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| pull_number: pr.number, | |
| event: 'APPROVE', | |
| body: '✅ 14-day quarantine period passed. Approving for merge.', | |
| }); | |
| console.log(`Approved PR #${pr.number} (created ${pr.created_at})`); | |
| } |