mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-10-15 08:02:53 +00:00
Alexander PetricandClaude Fable 5.1
81b0d588fb
Adds .github/workflows/dependabot-triage.yml, scheduled every Monday at
07:00 UTC and runnable on demand (workflow_dispatch, optional
alert_numbers subset). It pages through every open Dependabot alert into
.dependabot-triage/alerts.{json,tsv}, writes the per-severity and
per-manifest counts to the step summary, and (when there is at least one
alert) runs anthropics/claude-code-action@v1 with the triage policy in
.github/prompts/dependabot-triage.md.
A run produces at most one draft PR per ecosystem with targeted, checked
bumps (branch security/dependabot-<ecosystem>-<date>, title
"chore(security): resolve Dependabot alerts in <manifest>") and one issue
"Dependabot triage <date>" with the severity table, proposed dismissals
(reason + comment text, for a human to apply), unknowns, draft PR links and
"needs a human" items. A P0 produces only a "[P0]" issue with no detail.
The run never dismisses an alert, never merges, never pushes to main and
never edits .github/workflows/.
Tokens: the alerts are read with the default GITHUB_TOKEN under the
`vulnerability-alerts: read` job permission (GitHub workflow-syntax
reference: it "permits an action to list Dependabot alerts for the
repository"), so no PAT is needed. Claude uses CLAUDE_CODE_OAUTH_TOKEN
like the other Claude workflows. actionlint 1.7.12 does not know that
permission scope yet (rhysd/actionlint#713); it is the only finding.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>