okooooooo/3m-ui
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(security): add Dependabot config; harden .gitignore

Browse Source 
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
chore(security): add Dependabot config; harden .gitignore
Addresses audit findings M5, L4.
- Add .github/dependabot.yml covering Go (gomod /backend), npm
(/frontend), and github-actions ecosystems, with weekly cadence,
grouped minor/patch updates, and labelled PRs. This surfaces CVEs
like the jwt/quic-go issues automatically in future (currently the
repo has no automated dependency monitoring).
- .gitignore: exclude secrets and runtime state that were missing
(.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns
with the existing .dockerignore which already excludes .env.
This commit is contained in:
codebuddy committed 2026-09-14 13:02:56 +08:00
1 parent c8c9dcb98e
commit 72cee0e85e
2 files changed
+67 -4
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/dependabot.yml
+52
View File
@@ -0,0 +1,52 @@
version: 2
updates:
# Go backend dependencies
- package-ecosystem: "gomod"
directory: "/backend"
schedule:
interval: "weekly"
open-pull-requests-limit: 5
labels:
- "dependencies"
- "go"
commit-message:
prefix: "deps(go)"
# Group indirect/security updates to reduce PR noise.
groups:
indirect:
patterns:
- "*"
update-types:
- "minor"
- "patch"
# Frontend npm dependencies
- package-ecosystem: "npm"
directory: "/frontend"
schedule:
interval: "weekly"
open-pull-requests-limit: 5
labels:
- "dependencies"
- "npm"
commit-message:
prefix: "deps(npm)"
groups:
minor-patch:
patterns:
- "*"
update-types:
- "minor"
- "patch"
# GitHub Actions versions
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
open-pull-requests-limit: 5
labels:
- "dependencies"
- "ci"
commit-message:
prefix: "deps(ci)"
.gitignore
+15 -4
View File
@@ -1,9 +1,20 @@
frontend-variants/
# Dependencies
node_modules/
*.log
frontend-variants/
# Build / generated
*.log
# Python helper bytecode
__pycache__/
# Secrets & local state — never commit these.
.env
.env.*
*.db
*.db-*
*.key
*.pem
*.crt
*.csr
backend/data/