dependabot.yml

# Dependabot configuration for Comfy-Org/github-workflows.
# Docs: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
#
# This repo had NO Dependabot config until now, which is a sharper gap here than
# in a normal repo: everything this repo ships is a *reusable workflow*, so a
# stale action here is stale in every consumer repo simultaneously — and several
# of these workflows run with a bot App token that holds contents /
# pull-requests / issues write. That is the blast radius.
#
# The house rule is to pin third-party actions by full commit SHA (a tag is
# mutable, and a compromised action runs inside consumers' CI with their
# secrets). SHAs do not float, so without Dependabot they simply rot: a security
# fix in actions/checkout never arrives, and nothing fails to tell you so. Most
# `uses:` here are SHA-pinned already; a handful still sit on floating major
# tags. Dependabot will NOT convert a tag ref to a SHA, so those files get the
# least benefit from this config until they are pinned by hand — see the
# "Pin everything by full commit SHA" rule in AGENTS.md.
version: 2

updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      # Monthly, matching the callers' github-actions cadence. These are CI
      # actions, not runtime dependencies; weekly churn here buys noise. Security
      # updates are advisory-driven and are NOT bound by this interval — they
      # arrive as their own ungrouped PRs (the groups below declare no
      # `applies-to:`, so they cover version updates only).
      interval: "monthly"
    groups:
      # Grouped PRs rather than a dozen singles. Every caller pins THIS repo by
      # SHA, so each merge here obliges a fleet-wide caller bump
      # (bump-*-callers.yml opens those PRs automatically) — batching keeps that
      # to one bump per cycle instead of one per action.
      #
      # Majors are split out so one breaking major (say actions/checkout v7)
      # cannot hold every other action's patch hostage in an unmergeable PR
      # until someone unpicks it by hand.
      github-actions:
        patterns: ["*"]
        update-types: ["minor", "patch"]
      github-actions-major:
        patterns: ["*"]
        update-types: ["major"]
    # `dependencies` must already exist as a repo label — Dependabot applies
    # existing labels, it does not create the ones named here. It is also in
    # stale.yml's default `exempt_pr_labels`, which is what keeps these PRs from
    # being auto-staled while they wait on a fleet bump.
    labels: ["dependencies"]
    # Room for the two grouped PRs above plus headroom: each merge obliges a
    # fleet-wide caller bump, so PRs here sit open longer than usual, and once
    # the limit is hit Dependabot silently stops opening new ones.
    open-pull-requests-limit: 5
    cooldown:
      # Let a freshly-published version age before we adopt it, so a botched
      # release is usually yanked before it reaches consumer CI. The window has
      # to be wide enough to actually catch a yank — a 1-day window paired with
      # a monthly run would almost never bind, since the monthly run mostly sees
      # releases that are already weeks old.
      #
      # `default-days` is the only cooldown key the github-actions ecosystem
      # accepts — the `semver-*-days` variants are rejected at config-parse time
      # here (they need an ecosystem with semver-classified releases), which is
      # why majors get no longer window on this entry.
      default-days: 7
    ignore:
      # NEVER let Dependabot touch this repo's self-references.
      #
      # A caller of a reusable in this repo pins it TWICE — the `uses:` SHA and a
      # `workflows_ref:` input that loads the matching briefs/scripts at run time
      # — and the two MUST stay in lock-step or a run executes one version's
      # workflow against another version's scripts. Dependabot only understands
      # `uses:`; it rewrites the SHA and leaves `workflows_ref:` behind, producing
      # exactly that split state. This is not hypothetical — it has happened to
      # live callers.
      #
      # `bump-callers.sh` is the tool that rewrites BOTH, and it is the only thing
      # that should ever move these pins. The same ignore belongs in every
      # consumer repo's dependabot.yml.
      #
      # Scoped to this repo, not `Comfy-Org/*`: `ignore` suppresses security
      # updates as well as version updates, so an org-wide wildcard would
      # silently blacklist every future first-party action consumed here. The
      # trailing `*` covers both the `owner/repo` and `owner/repo/path.yml`
      # forms of the dependency name.
      - dependency-name: "Comfy-Org/github-workflows*"

      # Hold `create-github-app-token` at v1.x in the cross-repo bumpers.
      #
      # The v1.12.0 -> v3.2.0 jump in the 2026-07-30 major group (#95) broke the
      # `owner:`-without-`repositories:` token: every bump-*-callers.yml run since
      # has 403'd with "Resource not accessible by integration" on `tree create`
      # for every caller repo, silently stranding every consumer on a stale pin.
      # Verified against one repo across the boundary: cloud-code-bot[bot] wrote
      # one caller repo at 23:03 on v1.12.0 and 403'd on the same repo, same token
      # config, on v3.2.0. Neither the v2.0.0 nor the v3.0.0 release notes document
      # a scoping change, so this is pinned by evidence, not by changelog.
      #
      # Scoped to majors only: v1.x patches still arrive. Lifting this needs a
      # cross-repo write proven on a real caller, not a green unit-test run —
      # nothing in CI exercises the cross-repo path.
      #
      # NOTE: only the six bump-*-callers.yml workflows are held back. The
      # current-repo minters (groom.yml, cursor-review.yml, pr-size.yml, ...) do
      # not set `owner:`, are scoped to the running repo, and stay on v3.x.
      - dependency-name: "actions/create-github-app-token"
        update-types: ["version-update:semver-major"]

  # The @anthropic-ai/claude-code CLI that groom.yml installs in its three agent
  # jobs (BE-5373).
  #
  # `.github/groom/package.json` is not a project — nothing is ever installed
  # from that directory. It is a manifest whose only job is to make this pin
  # VISIBLE to an ecosystem: the github-actions ecosystem above only parses
  # `uses:` refs, so the previous inline `npm install -g <pkg>@<version>` literal
  # inside a `run:` step was watched by nothing at all and simply rotted. That
  # matters more than a normal dev-tool pin here, because those steps run inside
  # jobs holding a bot App token with contents / pull-requests / issues write.
  #
  # groom.yml's `gate` job reads the version out of that manifest once and feeds
  # all three install steps, so a bump PR merged here moves every call site at
  # once — there is no longer a version literal in the workflow to fall out of
  # sync.
  - package-ecosystem: "npm"
    directory: "/.github/groom"
    schedule:
      interval: "monthly"
    labels: ["dependencies"]
    # Keep the requirement EXACT. `increase` rewrites "1.2.3" -> "1.2.4" in
    # place; `widen` would turn the pin into a range, which groom.yml's gate
    # rejects at run time on purpose (an unpinned agent CLI is the supply-chain
    # hazard the pin exists to prevent). Stated explicitly rather than relying on
    # the ecosystem default, since that default is what the guard depends on.
    versioning-strategy: "increase"
    open-pull-requests-limit: 5
    cooldown:
      # A bump here changes what the agent CLI *is* inside jobs that read
      # untrusted repo content, so let a release age before adopting it. Majors
      # get longer: a CLI major can rename a flag or shift the default permission
      # mode, and groom's sandbox is built out of those flags.
      default-days: 7
      semver-major-days: 14

  # Same pattern, same reasons, for the @openai/codex pin behind
  # cursor-review.yml's opt-in direct-API cell. Its manifest installs nothing;
  # the job reads the version out of it and rejects a non-exact pin at run
  # time, hence `increase`. Without this entry the pin rots unwatched.
  - package-ecosystem: "npm"
    directory: "/.github/cursor-review"
    schedule:
      interval: "monthly"
    labels: ["dependencies"]
    versioning-strategy: "increase"
    open-pull-requests-limit: 5
    cooldown:
      default-days: 7
      semver-major-days: 14

  # The PyYAML + jsonschema pins the .coderabbit.yaml validator installs
  # (BE-7757). This is the repo's only Python dependency set, and it is
  # hash-pinned with `--require-hashes` — which is exactly why it needs watching:
  # a hash pin cannot float, so without Dependabot a security fix in either
  # package never arrives and nothing fails to say so. Dependabot regenerates the
  # hashes on a bump, so the file stays installable.
  - package-ecosystem: "pip"
    directory: "/.github/coderabbit-config"
    schedule:
      interval: "monthly"
    labels: ["dependencies"]
    # Keep the requirement EXACT. `widen` would turn the pin into a range, which
    # `--require-hashes` rejects outright at install time — the job would go red
    # in every enrolled repo rather than degrade quietly, but red-everywhere is
    # still not a state to schedule for yourself.
    versioning-strategy: "increase"
    open-pull-requests-limit: 5
    cooldown:
      # These run inside every consumer repo's CI, so let a release age before
      # adopting it. Majors get longer: a jsonschema major can change validator
      # semantics, which would silently change what this check MEANS — the unit
      # suite asserts the verdicts, so such a bump should be read, not rubber-
      # stamped.
      default-days: 7
      semver-major-days: 14

  # Dependency-free today, but declared so the day a module is added it is
  # watched rather than silently rotting — the same failure mode this file
  # exists to fix.
  - package-ecosystem: "gomod"
    directory: "/scripts/check-pr-size"
    schedule:
      interval: "monthly"
    labels: ["dependencies"]
    open-pull-requests-limit: 5
    cooldown:
      default-days: 7
      semver-major-days: 14