From f7edeaa1c628b6f4185e00c69cb12a9e58506872 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Tue, 27 Oct 2026 14:40:42 +0100 Subject: [PATCH 1/2] feat: group Dependabot security updates and cancel superseded PR runs in the templates --- .github/dependabot.yml | 3 +++ CHANGELOG.md | 2 ++ templates/dependabot.yml | 6 +++++- templates/workflows/status-checks-go.yml | 6 ++++++ templates/workflows/status-checks-node.yml | 6 ++++++ templates/workflows/terraform.yml | 6 ++++++ 6 files changed, 28 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index fc89d9a..c15bd8f 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,5 +7,8 @@ updates: groups: actions: patterns: ["*"] + actions-security: + applies-to: security-updates + patterns: ["*"] cooldown: default-days: 7 diff --git a/CHANGELOG.md b/CHANGELOG.md index f8c987f..5317c99 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,8 @@ ## Unreleased +- `templates/dependabot.yml`: security updates come as one grouped PR per ecosystem (`applies-to: security-updates`) instead of one PR per package. The version-update groups never applied to them. +- Caller templates: a new push to a pull request cancels that pull request's previous Status checks run (workflow-level `concurrency`). Push, schedule and merge-queue runs are never cancelled. - Templates: no `codeql` job. Public repositories in the organization get CodeQL through default setup, which rejects results from `codeql.yml`. ## v1.1.3 diff --git a/templates/dependabot.yml b/templates/dependabot.yml index 38cc29e..eb15363 100644 --- a/templates/dependabot.yml +++ b/templates/dependabot.yml @@ -1,5 +1,6 @@ # Copy to .github/dependabot.yml in every repository and delete the -# ecosystems you don't use. Updates are grouped (one PR per ecosystem) and +# ecosystems you don't use. Updates are grouped (one PR per ecosystem, and +# one for its security updates) and # wait 7 days after a release (cooldown) so compromised releases are usually # yanked before they reach us. Security updates are not delayed. version: 2 @@ -9,6 +10,7 @@ updates: schedule: { interval: weekly, day: monday } groups: actions: { patterns: ["*"] } + actions-security: { applies-to: security-updates, patterns: ["*"] } cooldown: { default-days: 7 } - package-ecosystem: docker # bumps tag AND @sha256 digest of FROM lines @@ -23,6 +25,7 @@ updates: schedule: { interval: weekly, day: monday } groups: go: { patterns: ["*"], update-types: [minor, patch] } + go-security: { applies-to: security-updates, patterns: ["*"] } cooldown: { default-days: 7 } - package-ecosystem: npm @@ -31,6 +34,7 @@ updates: groups: npm-production: { dependency-type: production, update-types: [minor, patch] } npm-development: { dependency-type: development, update-types: [minor, patch] } + npm-security: { applies-to: security-updates, patterns: ["*"] } cooldown: { default-days: 7 } - package-ecosystem: terraform diff --git a/templates/workflows/status-checks-go.yml b/templates/workflows/status-checks-go.yml index 458f5b6..4c32abb 100644 --- a/templates/workflows/status-checks-go.yml +++ b/templates/workflows/status-checks-go.yml @@ -12,6 +12,12 @@ on: permissions: {} +# A new push to a PR cancels the PR's previous run. Other events get a +# group of their own (run_id), so they never wait for or cancel each other. +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} + cancel-in-progress: true + jobs: go: uses: privacybydesign/github-workflows/.github/workflows/go-checks.yml@v1 diff --git a/templates/workflows/status-checks-node.yml b/templates/workflows/status-checks-node.yml index 5b209b3..bc021dd 100644 --- a/templates/workflows/status-checks-node.yml +++ b/templates/workflows/status-checks-node.yml @@ -12,6 +12,12 @@ on: permissions: {} +# A new push to a PR cancels the PR's previous run. Other events get a +# group of their own (run_id), so they never wait for or cancel each other. +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} + cancel-in-progress: true + jobs: node: uses: privacybydesign/github-workflows/.github/workflows/node-checks.yml@v1 diff --git a/templates/workflows/terraform.yml b/templates/workflows/terraform.yml index e4b1b79..cdf0591 100644 --- a/templates/workflows/terraform.yml +++ b/templates/workflows/terraform.yml @@ -13,6 +13,12 @@ on: permissions: {} +# A new push to a PR cancels the PR's previous run. Other events get a +# group of their own (run_id), so they never wait for or cancel each other. +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} + cancel-in-progress: true + jobs: terraform: strategy: From fd5537c974fb77b6ad7405cd1ce1ff3e5ac4dd62 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Tue, 27 Oct 2026 14:40:54 +0100 Subject: [PATCH 2/2] docs: reflow the dependabot template header --- templates/dependabot.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/templates/dependabot.yml b/templates/dependabot.yml index eb15363..430e6bc 100644 --- a/templates/dependabot.yml +++ b/templates/dependabot.yml @@ -1,8 +1,8 @@ # Copy to .github/dependabot.yml in every repository and delete the -# ecosystems you don't use. Updates are grouped (one PR per ecosystem, and -# one for its security updates) and -# wait 7 days after a release (cooldown) so compromised releases are usually -# yanked before they reach us. Security updates are not delayed. +# ecosystems you don't use. Updates are grouped (one PR per ecosystem, plus +# one for its security updates) and wait 7 days after a release (cooldown) +# so compromised releases are usually yanked before they reach us. Security +# updates are not delayed. version: 2 updates: - package-ecosystem: github-actions # also bumps the shared workflows