From 17108124908187ac9a6efb92f46aeefefccaea37 Mon Sep 17 00:00:00 2001 From: Ayinkx Date: Wed, 15 Jul 2026 11:54:40 -0700 Subject: [PATCH 1/3] ci(onchain): enforce Cargo.lock for wasm contract builds --- .github/workflows/contract-ci.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/.github/workflows/contract-ci.yml b/.github/workflows/contract-ci.yml index d26fb21c..52cea7d7 100644 --- a/.github/workflows/contract-ci.yml +++ b/.github/workflows/contract-ci.yml @@ -33,6 +33,19 @@ jobs: with: workspaces: "app/onchain" + - name: Enforce locked dependencies + run: cargo check --locked + + - name: Ensure Cargo.lock is updated when Cargo.toml changes + if: github.event_name == 'pull_request' + run: | + git fetch origin "${{ github.base_ref }}" --depth=1 + changed_files="$(git diff --name-only "origin/${{ github.base_ref }}...HEAD" -- app/onchain/Cargo.toml app/onchain/Cargo.lock)" + if echo "$changed_files" | grep -q '^app/onchain/Cargo.toml$' && ! echo "$changed_files" | grep -q '^app/onchain/Cargo.lock$'; then + echo "Cargo.toml changed without updating Cargo.lock." + exit 1 + fi + - name: Check formatting run: cargo fmt --all -- --check From b142ce956e77706ce2c9b52dffc2f3ae88c15fd1 Mon Sep 17 00:00:00 2001 From: Ayinkx Date: Wed, 15 Jul 2026 12:11:27 -0700 Subject: [PATCH 2/3] ci: enable dependabot and renovate for dependency updates --- .github/dependabot.yml | 76 ++++++++++++++++++++++++++++++++---------- .github/renovate.json | 34 +++++++++++++++++++ 2 files changed, 93 insertions(+), 17 deletions(-) create mode 100644 .github/renovate.json diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 3619f9eb..0ea20e0c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,23 +1,65 @@ -# Dependabot version updates are intentionally disabled on this repository. -# -# The Dependabot configuration schema requires at least one entry under -# `updates`. The minimum-viable disable below uses the GitHub Actions -# ecosystem with `open-pull-requests-limit: 0` so that Dependabot cannot -# open any pull request, and by listing only one ecosystem here we ensure -# that no other ecosystem (npm, pip, cargo, etc.) will be scanned at all. -# -# To re-enable Dependabot in the future, replace this file with a full -# configuration generated from the official options reference: -# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file -# -# Note: this file only governs Dependabot *version* updates. To also -# disable Dependabot *security* updates, toggle the repo setting -# "Dependabot security updates" off under -# Settings -> Code security and analysis on GitHub. version: 2 updates: + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 10 + labels: + - "dependencies" + - "npm" + commit-message: + prefix: "chore(deps)" + include: "scope" + groups: + npm-dependencies: + patterns: + - "*" + + - package-ecosystem: "cargo" + directory: "/app/onchain" + schedule: + interval: "weekly" + open-pull-requests-limit: 10 + labels: + - "dependencies" + - "cargo" + commit-message: + prefix: "chore(deps)" + include: "scope" + groups: + cargo-dependencies: + patterns: + - "*" + + - package-ecosystem: "pip" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 10 + labels: + - "dependencies" + - "pip" + commit-message: + prefix: "chore(deps)" + include: "scope" + groups: + pip-dependencies: + patterns: + - "*" + - package-ecosystem: "github-actions" directory: "/" schedule: interval: "weekly" - open-pull-requests-limit: 0 + open-pull-requests-limit: 10 + labels: + - "dependencies" + - "github-actions" + commit-message: + prefix: "chore(deps)" + include: "scope" + groups: + github-actions-dependencies: + patterns: + - "*" diff --git a/.github/renovate.json b/.github/renovate.json new file mode 100644 index 00000000..8c195cff --- /dev/null +++ b/.github/renovate.json @@ -0,0 +1,34 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "config:recommended", + "docker:pinDigests", + "helpers:pinGitHubActionDigests" + ], + "packageRules": [ + { + "matchManagers": ["npm"], + "groupName": "npm dependencies", + "schedule": ["before 5am on monday"] + }, + { + "matchManagers": ["cargo"], + "groupName": "cargo dependencies", + "schedule": ["before 5am on monday"] + }, + { + "matchManagers": ["pip_requirements"], + "groupName": "pip dependencies", + "schedule": ["before 5am on monday"] + }, + { + "matchManagers": ["github-actions"], + "groupName": "github-actions dependencies", + "schedule": ["before 5am on monday"] + } + ], + "prHourlyLimit": 0, + "prConcurrentLimit": 5, + "labels": ["dependencies"], + "commitMessagePrefix": "chore(deps):" +} From 3cb12bd1193cdf9beae70be942d0f367a10c385d Mon Sep 17 00:00:00 2001 From: Ayinkx Date: Fri, 17 Jul 2026 11:02:55 -0700 Subject: [PATCH 3/3] ci: title dependency updates by ecosystem (#302) --- .github/dependabot.yml | 8 ++++---- .github/renovate.json | 4 ++++ 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 0ea20e0c..5ce07294 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,7 +9,7 @@ updates: - "dependencies" - "npm" commit-message: - prefix: "chore(deps)" + prefix: "chore(npm)" include: "scope" groups: npm-dependencies: @@ -25,7 +25,7 @@ updates: - "dependencies" - "cargo" commit-message: - prefix: "chore(deps)" + prefix: "chore(cargo)" include: "scope" groups: cargo-dependencies: @@ -41,7 +41,7 @@ updates: - "dependencies" - "pip" commit-message: - prefix: "chore(deps)" + prefix: "chore(pip)" include: "scope" groups: pip-dependencies: @@ -57,7 +57,7 @@ updates: - "dependencies" - "github-actions" commit-message: - prefix: "chore(deps)" + prefix: "chore(actions)" include: "scope" groups: github-actions-dependencies: diff --git a/.github/renovate.json b/.github/renovate.json index 8c195cff..9373aeff 100644 --- a/.github/renovate.json +++ b/.github/renovate.json @@ -9,21 +9,25 @@ { "matchManagers": ["npm"], "groupName": "npm dependencies", + "commitMessagePrefix": "chore(npm):", "schedule": ["before 5am on monday"] }, { "matchManagers": ["cargo"], "groupName": "cargo dependencies", + "commitMessagePrefix": "chore(cargo):", "schedule": ["before 5am on monday"] }, { "matchManagers": ["pip_requirements"], "groupName": "pip dependencies", + "commitMessagePrefix": "chore(pip):", "schedule": ["before 5am on monday"] }, { "matchManagers": ["github-actions"], "groupName": "github-actions dependencies", + "commitMessagePrefix": "chore(actions):", "schedule": ["before 5am on monday"] } ],