From 72cee0e85e8e787adae79dd4b027c75eecb6699d Mon Sep 17 00:00:00 2001 From: codebuddy Date: Mon, 14 Sep 2026 13:02:56 +0800 Subject: [PATCH] chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. chore(security): add Dependabot config; harden .gitignore Addresses audit findings M5, L4. - Add .github/dependabot.yml covering Go (gomod /backend), npm (/frontend), and github-actions ecosystems, with weekly cadence, grouped minor/patch updates, and labelled PRs. This surfaces CVEs like the jwt/quic-go issues automatically in future (currently the repo has no automated dependency monitoring). - .gitignore: exclude secrets and runtime state that were missing (.env, *.db / *.db-*, *.key, *.pem, *.crt, backend/data/). Aligns with the existing .dockerignore which already excludes .env. --- .github/dependabot.yml | 52 ++++++++++++++++++++++++++++++++++++++++++ .gitignore | 19 +++++++++++---- 2 files changed, 67 insertions(+), 4 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..b2b08fe --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,52 @@ +version: 2 +updates: + # Go backend dependencies + - package-ecosystem: "gomod" + directory: "/backend" + schedule: + interval: "weekly" + open-pull-requests-limit: 5 + labels: + - "dependencies" + - "go" + commit-message: + prefix: "deps(go)" + # Group indirect/security updates to reduce PR noise. + groups: + indirect: + patterns: + - "*" + update-types: + - "minor" + - "patch" + + # Frontend npm dependencies + - package-ecosystem: "npm" + directory: "/frontend" + schedule: + interval: "weekly" + open-pull-requests-limit: 5 + labels: + - "dependencies" + - "npm" + commit-message: + prefix: "deps(npm)" + groups: + minor-patch: + patterns: + - "*" + update-types: + - "minor" + - "patch" + + # GitHub Actions versions + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 5 + labels: + - "dependencies" + - "ci" + commit-message: + prefix: "deps(ci)" diff --git a/.gitignore b/.gitignore index 76a9eb6..bb7422b 100644 --- a/.gitignore +++ b/.gitignore @@ -1,9 +1,20 @@ - -frontend-variants/ +# Dependencies node_modules/ -*.log - frontend-variants/ +# Build / generated +*.log + # Python helper bytecode __pycache__/ + +# Secrets & local state — never commit these. +.env +.env.* +*.db +*.db-* +*.key +*.pem +*.crt +*.csr +backend/data/