Branch protection and Renovate dependency automation #130

New issue

Closed

opened 2026-07-28 17:34:49 +00:00 by claude-bot · 1 comment

claude-bot commented

2026-07-28 17:34:49 +00:00

What was done

Branch protection on main and a Renovate configuration, so dependency updates can be managed
automatically without letting anything merge unreviewed or untested.

Branch protection on `main`

Setting	Value
Status checks required	`CI / backend`, `CI / frontend`
Push whitelist	`rbrooks` only
Required approvals	0
Force push	blocked
Block on rejected reviews	yes
Block on outdated branch	no

Chosen deliberately: direct pushes by the repo owner still work. Bots and any future
collaborator must go through a pull request that CI gates. The alternative — every change via PR,
including the owner's — was considered and rejected as disproportionate for a solo maintainer.

required_approvals is 0 because Renovate automerge cannot work otherwise; CI is the gate, not a
human approval.

Wildcard contexts (CI / backend*) are used because Forgejo reports the event in the context name —
CI / backend (push) versus CI / backend (pull_request) — so an exact match would only ever
satisfy one of them.

Renovate (`renovate.json`)

Patch and minor automerge once CI is green; majors always wait for review
Weekly schedule, 5 concurrent PRs, 2/hour, so it cannot flood the repo
Monthly lock file maintenance
Python dependencies grouped into one PR; @types/* grouped
Never automerged, even on a patch: authlib, pillow, itsdangerous, python-multipart.
Authlib validates every ID token and Pillow parses attacker-supplied uploads — a regression in
either is a security incident, not an inconvenience.
vulnerabilityAlerts enabled, labelled security, never automerged

Three major updates are already queued and will wait for review: @vitejs/plugin-react v6,
typescript v7, vite v8.

Caveat

Automerge is only as good as the tests behind it, and there are currently no tests (#5). Until
the suite lands, a green CI run means "it lints, migrations apply, and it builds" — not "it works."
That is a real but acceptable bar for patch and minor updates; it is exactly why majors are held.

Worth revisiting the automerge scope once #5 through #12 land.

References

renovate.json
Renovate onboarding PR #1 — should be merged now that lockfiles exist

Related: #13 (CI pipeline), #72 (lockfiles and audit tooling).

## What was done Branch protection on `main` and a Renovate configuration, so dependency updates can be managed automatically without letting anything merge unreviewed or untested. ## Branch protection on `main` | Setting | Value | |---|---| | Status checks required | `CI / backend*`, `CI / frontend*` | | Push whitelist | `rbrooks` only | | Required approvals | 0 | | Force push | blocked | | Block on rejected reviews | yes | | Block on outdated branch | no | **Chosen deliberately: direct pushes by the repo owner still work.** Bots and any future collaborator must go through a pull request that CI gates. The alternative — every change via PR, including the owner's — was considered and rejected as disproportionate for a solo maintainer. `required_approvals` is 0 because Renovate automerge cannot work otherwise; CI is the gate, not a human approval. Wildcard contexts (`CI / backend*`) are used because Forgejo reports the event in the context name — `CI / backend (push)` versus `CI / backend (pull_request)` — so an exact match would only ever satisfy one of them. ## Renovate (`renovate.json`) - **Patch and minor automerge** once CI is green; **majors always wait** for review - Weekly schedule, 5 concurrent PRs, 2/hour, so it cannot flood the repo - Monthly lock file maintenance - Python dependencies grouped into one PR; `@types/*` grouped - **Never automerged, even on a patch:** `authlib`, `pillow`, `itsdangerous`, `python-multipart`. Authlib validates every ID token and Pillow parses attacker-supplied uploads — a regression in either is a security incident, not an inconvenience. - `vulnerabilityAlerts` enabled, labelled `security`, never automerged Three major updates are already queued and will wait for review: `@vitejs/plugin-react` v6, `typescript` v7, `vite` v8. ## Caveat Automerge is only as good as the tests behind it, and there are currently **no tests** (#5). Until the suite lands, a green CI run means "it lints, migrations apply, and it builds" — not "it works." That is a real but acceptable bar for patch and minor updates; it is exactly why majors are held. Worth revisiting the automerge scope once #5 through #12 land. ## References - `renovate.json` - Renovate onboarding PR #1 — should be merged now that lockfiles exist Related: #13 (CI pipeline), #72 (lockfiles and audit tooling).

claude-bot added this to the v0.1.1 milestone

2026-07-28 17:34:49 +00:00

claude-bot added the

security

infra

labels

2026-07-28 17:34:49 +00:00

claude-bot referenced this issue

2026-07-30 21:17:33 +00:00

Upgrade react-router to v8 to clear GHSA-qwww-vcr4-c8h2 #132

claude-bot commented

2026-07-30 23:09:01 +00:00

Author

Closing per your call — the work this issue records (branch protection on main, renovate.json) is done and shipped, so the issue has no outstanding scope of its own.

Two updates since it was written:

The caveat about tests is now stale. This issue notes "automerge is only as good as the tests behind it, and there are currently no tests (#5)... a green CI run means 'it lints, migrations apply, and it builds' — not 'it works.'" That is no longer the case: the suite is at 316 tests, built on a harness whose schema comes from Alembic against a file-backed SQLite database, so migrations and pragma behaviour are exercised on every run. CI also now gates on pip-audit and an npm audit allowlist gate (#72). Green means materially more than it did.

The automerge scope is worth revisiting in that light, as this issue suggested — though the security-package holdouts (authlib, pillow, itsdangerous, python-multipart) should stay manual regardless, and #65 has just made Pillow's blast radius a lot smaller without making a regression in it any less worth reading.

Renovate PR #1 is still unmerged and is tracked as the one open item on #72's checklist. It needs you rather than me, and it should not hold the v0.1.1 milestone — hence closing this.

One related note from #68 for whenever the deployment work (#50) lands: CIRCA_TRUST_PROXY_HEADERS defaults to false and must be turned on once a reverse proxy is in front, or every request will appear to come from the proxy's address and the per-address auth rate limit will collapse into a single global one.

Closing per your call — the work this issue records (branch protection on `main`, `renovate.json`) is done and shipped, so the issue has no outstanding scope of its own. Two updates since it was written: **The caveat about tests is now stale.** This issue notes "automerge is only as good as the tests behind it, and there are currently **no tests** (#5)... a green CI run means 'it lints, migrations apply, and it builds' — not 'it works.'" That is no longer the case: the suite is at **316 tests**, built on a harness whose schema comes from Alembic against a file-backed SQLite database, so migrations and pragma behaviour are exercised on every run. CI also now gates on `pip-audit` and an `npm audit` allowlist gate (#72). Green means materially more than it did. The automerge scope is worth revisiting in that light, as this issue suggested — though the security-package holdouts (`authlib`, `pillow`, `itsdangerous`, `python-multipart`) should stay manual regardless, and #65 has just made Pillow's blast radius a lot smaller without making a regression in it any less worth reading. **Renovate PR #1 is still unmerged** and is tracked as the one open item on #72's checklist. It needs you rather than me, and it should not hold the v0.1.1 milestone — hence closing this. One related note from #68 for whenever the deployment work (#50) lands: `CIRCA_TRUST_PROXY_HEADERS` defaults to `false` and **must be turned on once a reverse proxy is in front**, or every request will appear to come from the proxy's address and the per-address auth rate limit will collapse into a single global one.

claude-bot closed this issue

2026-07-30 23:09:05 +00:00