Skip to content

Use GitHub-native dependency maintenance - #581

Merged
leopiccionia merged 7 commits into
InfoAmazonia:developfrom
bwstefano:codex/github-dependency-maintenance
Jun 2, 2026
Merged

Use GitHub-native dependency maintenance#581
leopiccionia merged 7 commits into
InfoAmazonia:developfrom
bwstefano:codex/github-dependency-maintenance

Conversation

@bwstefano

@bwstefano bwstefano commented May 21, 2026

Copy link
Copy Markdown
Member

Summary

This PR removes the repository-owned dependency report generator and moves routine dependency maintenance to GitHub-native tooling.

Changes

  • Adds Dependabot weekly version updates for npm, Composer, and GitHub Actions against develop.
  • Adds a Dependency Review workflow on pull requests, failing on newly introduced high-severity vulnerabilities or worse.
  • Removes scripts/dependency-review.mjs, its overrides data file, and the generated long-form dependency reports.
  • Removes deps:report npm script.
  • Replaces the generated report docs with a short dependency maintenance policy.
  • Updates MkDocs navigation to point at the new policy page.

Dependency

This PR should be merged after #580. The branch intentionally includes the resolved #580 history so removing docs/dev/dependency-upgrade-smoke-tests.md happens after the transitional npm/Size Limit documentation updates, avoiding a modify/delete conflict in the full integration sequence.

Once the earlier PRs are merged into develop, this PR can be updated/rebased and its visible diff should collapse back to the GitHub-native dependency maintenance changes.

Validation

  • git diff --check upstream/develop..codex/github-dependency-maintenance
  • python3 -m mkdocs build --clean --site-dir /tmp/jeo-plugin-mkdocs-check
  • Temporary full integration test through Restructure documentation site publishing #583 completed without merge conflicts using this branch.
  • GitHub Actions should validate Dependency Review and the existing project checks.

@bwstefano bwstefano added this to the 3.0 milestone May 21, 2026
@bwstefano
bwstefano force-pushed the codex/github-dependency-maintenance branch from 95d1349 to 30ed742 Compare May 21, 2026 18:13
bwstefano and others added 3 commits May 21, 2026 15:53
Co-authored-by: Codex <codex@openai.com>
Co-authored-by: Codex <codex@openai.com>
Co-authored-by: Codex <codex@openai.com>
@bwstefano
bwstefano force-pushed the codex/github-dependency-maintenance branch from 30ed742 to 7267972 Compare May 21, 2026 18:55
bwstefano added 3 commits May 21, 2026 17:02
…node-runtime

# Conflicts:
#	docs/dev/dependency-upgrade-smoke-tests.md
…dency-maintenance

# Conflicts:
#	docs/dev/dependency-upgrade-smoke-tests.md
@leopiccionia
leopiccionia marked this pull request as ready for review June 2, 2026 18:58
@leopiccionia
leopiccionia merged commit 8daffa7 into InfoAmazonia:develop Jun 2, 2026
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants