Repository navigation
chore: review security majors and show per-PR verification in /dependabot-triage - #212
Merged
Merged
Conversation
…abot-triage Port NearDeFi/repo-automation-setup#3: the measurement gate and a new major + security rule now sit above the plain security rule, so a security major gets its migration review and e2e/manual run, and never the `@dependabot ignore` option. Add a Verify column to the PR table so every row says what must pass before merging (CI, no CI job, /run-e2e suite, manual run, or measurement re-approval), and route tests-in-tee / test-image deps to /run-e2e tee since they have no CI job.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates
/dependabot-triage(.claude/commands/dependabot-triage.md) only.⛔ measurements→ major + security → major → security → superseded → minor → patch. A security major is🔴 Security fix, major — review migration, then merge ASAP, never@dependabot ignore(that leaves the vulnerability open); the fallback is a patched release on the current major or the Phase 8 override / replace options. A⛔PR that's also a security fix gets a🔴 Security fix ·prefix. Merge order puts security fixes first.Verifycolumn in the PR table. Every row now states what must pass before merging:CI,none (no CI job),🧪 /run-e2e contract|tee/🧪 /run-e2e,🔧 manual,⛔ /run-e2e tee + re-approve,CI after fix, or—. Before this, the🧪/🔧note was only appended to majors' action text, so for most rows you had to read the guidance blocks to learn CI was enough. The summary also counts PRs by Verify value.tests-in-tee/andtests-in-tee/test-image/deps route to/run-e2e tee. They have no CI job (everyci-passedpackage job is skipped), so the e2e suite is their only test. Majors there were previously routed by judgment.Release impact
No release impact — touches no published package.
Test plan
/dependabot-triageand confirm every PR row has a Verify value, and a security major (e.g. chore(deps): bump @hono/node-server from 1.19.13 to 2.0.10 in /tests-in-tee/test-image #181) gets rule 4 plus🧪 /run-e2e tee.🤖 Generated with Claude Code