mirror of
https://github.com/verdaccio/verdaccio.git
synced 2024-12-16 21:56:25 -05:00
28b97ec16b
- https://docs.renovatebot.com/modules/manager/github-actions/#additional-information
- Pinned actions by SHA https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies
>Pin actions to a full length commit SHA
>Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.
> Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository,
> as they would need to generate a SHA-1 collision for a valid Git object payload.
- https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
- b0c3aa85ef/default.json (L13)
135 lines
3.1 KiB
JSON
135 lines
3.1 KiB
JSON
{
|
|
"extends": ["config:base", "schedule:earlyMondays","helpers:pinGitHubActionDigests"],
|
|
"prConcurrentLimit": 1,
|
|
"ignorePaths": ["docker-examples/**"],
|
|
"ignoreDeps": ["eslint-plugin-verdaccio", "@verdaccio/test-helper"],
|
|
"baseBranches": ["master", "5.x"],
|
|
"major": true,
|
|
"labels": ["bot: dependencies"],
|
|
"packageRules": [
|
|
{
|
|
"packageNames": ["aws-sdk"],
|
|
"allowedVersions": "2.607.0"
|
|
},
|
|
{
|
|
"packageNames": ["@google-cloud/datastore"],
|
|
"allowedVersions": "4.5.0"
|
|
},
|
|
{
|
|
"packageNames": ["@google-cloud/storage"],
|
|
"allowedVersions": "3.5.0"
|
|
},
|
|
{
|
|
"packageNames": ["fast-crc32c"],
|
|
"allowedVersions": "1.0.7"
|
|
},
|
|
{
|
|
"packageNames": ["esbuild"],
|
|
"allowedVersions": "0.14.10"
|
|
},
|
|
{
|
|
"packageNames": ["esbuild-loader"],
|
|
"allowedVersions": "2.16.0"
|
|
},
|
|
{
|
|
"packageNames": ["lowdb"],
|
|
"allowedVersions": "1.0.0"
|
|
},
|
|
{
|
|
"packageNames": ["node-fetch"],
|
|
"allowedVersions": "< 3.0.0"
|
|
},
|
|
{
|
|
"packageNames": ["@changesets/cli"],
|
|
"allowedVersions": "2.15.0"
|
|
},
|
|
{
|
|
"matchDatasources": ["docker"],
|
|
"labels": ["bot: docker-update"]
|
|
},
|
|
{
|
|
"matchDatasources": ["crazy-max/ghaction-docker-meta"],
|
|
"allowedVersions": "1.12.0"
|
|
},
|
|
{
|
|
"matchDatasources": ["react-router"],
|
|
"allowedVersions": "5.2.1"
|
|
},
|
|
{
|
|
"matchDatasources": ["react-router-dom"],
|
|
"allowedVersions": "5.2.1"
|
|
},
|
|
{
|
|
"matchDatasources": ["actions/github-script"],
|
|
"allowedVersions": "v3"
|
|
},
|
|
{
|
|
"matchDatasources": ["lint-staged"],
|
|
"allowedVersions": "11.2.6"
|
|
},
|
|
{
|
|
"matchDatasources": ["get-port"],
|
|
"allowedVersions": "5.1.1"
|
|
},
|
|
{
|
|
"matchPackagePatterns": [
|
|
"@types/*",
|
|
"typescript",
|
|
"@babel/*",
|
|
"fast-safe-stringify",
|
|
"undici",
|
|
"verdaccio*",
|
|
"webpack",
|
|
"async",
|
|
"memfs",
|
|
"globby",
|
|
"pnpm",
|
|
"esbuild",
|
|
"@emotion/*",
|
|
"async",
|
|
"@mui/*",
|
|
"express*",
|
|
"http-status",
|
|
"babel-*",
|
|
"jest",
|
|
"jest-*",
|
|
"pino",
|
|
"react*",
|
|
"ts-node",
|
|
"mini-css*",
|
|
"autocannon",
|
|
"process-warning",
|
|
"fastify",
|
|
"core-js",
|
|
"debug",
|
|
"nock",
|
|
"rimraf",
|
|
"node-fetch",
|
|
"kleur",
|
|
"fs-extra",
|
|
"self-signed",
|
|
"supertest"
|
|
],
|
|
"matchUpdateTypes": ["minor", "patch", "major"],
|
|
"groupName": "all core dependencies",
|
|
"groupSlug": "all-core-dependencies",
|
|
"extends": [":semanticCommitTypeAll(fix)"],
|
|
"baseBranchList": ["master"]
|
|
},
|
|
{
|
|
"matchPackagePatterns": [
|
|
"@trivago/*",
|
|
"prettier",
|
|
"eslint-*",
|
|
"eslint",
|
|
"stylelint",
|
|
"@typescript-eslint/*"
|
|
],
|
|
"matchUpdateTypes": ["minor", "patch", "major"],
|
|
"groupName": "all linting dependencies",
|
|
"groupSlug": "all-linting",
|
|
"baseBranchList": ["master"]
|
|
}
|
|
],
|
|
"pinVersions": false
|
|
}
|