Katsuhide Tsuruta
d391f29820
Add a low-frequency (monthly + manual) security workflow that resolves dependencies with uv and audits them against the OSV / PyPI Advisory DB via pip-audit, failing the job when a vulnerability is found. Also add Dependabot (pip + github-actions, monthly) to auto-open PRs that bump dependencies to fixed versions. PRs are review/merge by hand (no auto-merge) since there is no test-gating CI yet. Closes #11
19 lines
449 B
YAML
19 lines
449 B
YAML
version: 2
|
|
updates:
|
|
# Python dependencies declared in pyproject.toml ([project.dependencies])
|
|
- package-ecosystem: "pip"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "monthly"
|
|
open-pull-requests-limit: 5
|
|
commit-message:
|
|
prefix: "chore(deps)"
|
|
|
|
# Actions used in .github/workflows/*
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "monthly"
|
|
commit-message:
|
|
prefix: "ci(deps)"
|