Enable dependency alerts, automated updates, and main-branch protection

[itsjling]

Problem

The repository currently has no branch protection or rulesets. Dependabot alerts and security updates are disabled, and there is no dependency-update config. These gaps weaken supply-chain controls even though the current production dependency audit reports no known vulnerabilities.

Scope

• Enable the dependency graph, Dependabot alerts, and Dependabot security updates.
• Add .github/dependabot.yml for the pnpm package graph and GitHub Actions.
• Use a measured update schedule and pull-request limit so updates remain reviewable.
• Add a main branch rule that blocks force pushes and deletion.
• Require pull requests and the stable CI checks that must pass before merge.
• Decide whether to require one approving review; record the choice in this issue.
• Confirm repository admins retain a documented recovery path.

Acceptance checks

• GitHub reports vulnerability alerts and security updates as enabled.
• Dependabot can open version-update PRs for npm and GitHub Actions.
• Direct pushes that bypass the chosen rule are blocked for the intended actors.
• Required checks match current workflow job names and do not deadlock scheduled or manual runs.
• The initial OpenSSF Scorecard result detects the dependency-update tool and branch rule.
• corepack pnpm run lint and corepack pnpm test pass for file changes.

Current evidence

• main returns “Branch not protected.”
• The repository has no rulesets.
• Dependabot alerts are disabled.
• Dependabot security updates are disabled.
• corepack pnpm audit --prod reports zero known vulnerabilities today; this ticket is about continued detection and safe updates.

[itsjling]

This was generated by AI during triage.

Agent Brief

Category: enhancement
Summary: Enable dependency alerts and update PRs, and protect main while preserving releases from main.

Maintainer decisions:

• Normal changes require a PR and passing CI. No second-person approval is required.
• Releases run from main without a release PR. Permit the release workflow's direct push through a narrowly scoped exception.
• Keep admin access for emergency recovery. Document the bypass and record each use and reason in the affected issue or PR.
• Dependabot opens weekly version-update PRs for npm and GitHub Actions, with at most five open version-update PRs per ecosystem. Do not enable automatic merging.

Current behavior:
Triage confirmed that GitHub has no repository rulesets or main-branch protection, vulnerability alerts are disabled, and automated security fixes are disabled. No Dependabot configuration exists. The release finalizer atomically pushes a release commit to main and its tag before npm publishing. A PR-only rule without a release exception would block that flow. Triage checked repository settings, workflow definitions, and release finalization; the requested safeguards are not already present. No prior rejection was found.

Desired behavior:
Enable the dependency graph, Dependabot alerts, security updates, and weekly version updates for the pnpm package graph and GitHub Actions. Protect main against normal direct pushes, force pushes, and deletion. Require stable checks that run on PRs. Preserve releases from main and admin recovery without giving normal contributors or dependency-update PRs the release exception.

Key interfaces:

• GitHub repository security settings and main-branch rules.
• Dependabot ecosystem, schedule, and open-PR-limit configuration. The weekly schedule and five-PR cap concern version updates; retain security-update support.
• PR status checks: inspect current check names and triggers before making them required. Do not require scheduled-only, manual-only, or live-provider checks on PRs.
• Release authorization and pushRelease: preserve the verified commit-and-tag push before npm publication. Confirm that the actual release identity can use the exception; do not assume the default workflow token can bypass protection.

Acceptance criteria:

• GitHub reports the dependency graph, alerts, and security updates enabled.
• Dependabot accepts both ecosystem configurations and can create update PRs on the agreed schedule, with the version-update limits and no automatic merging.
• Main requires PRs and passing CI for normal changes, with zero required approving reviews; force pushes and deletion are blocked for normal actors.
• Required check names match current PR runs and cannot leave a PR waiting for a check that never runs.
• A verified release from main can push its release commit and tag without a release PR. The exception applies only to the intended release identity and emergency admins.
• Document the admin recovery steps, release exception, and requirement to record emergency bypass use. Verify enforcement without publishing an unrequested npm release or disrupting main.
• Check the initial OpenSSF Scorecard result for the dependency-update tool and branch rule when that run is available; explain any result affected by the agreed exceptions.
• corepack pnpm run lint and corepack pnpm test pass for file changes; run corepack pnpm run docs:check for docs changes.

Out of scope:

• Mandatory second-person reviews, release PRs, or automatic dependency-update merging.
• Broad contributor bypass rights or an unrequested production release.

[itsjling]

Implementation is in progress on t3code/complete-issue-129-1, targeting main.

The agreed review policy is zero required approving reviews. Normal changes require a PR, resolved threads, and the GitHub Actions checks Automation trust review, Product gate (Node 24.20.0), unit, integration, and browser. Admin bypass is for emergency recovery, with each use recorded in the affected issue or PR.

Live settings verified on 2026-09-06:

• Alerts return HTTP 204; security fixes are enabled and not paused. The dependency graph exports 1,068 SBOM packages. These settings were already enabled when implementation started.
• Automatic merging is disabled.
• main-history, ruleset 22360424, is active and blocks force pushes and deletion. Only admins bypass it.
• main-review, ruleset 22360425, is staged as disabled until the release workflow change merges. Enabling it against today's workflow would break release pushes.
• The sole write deploy key is npm-publish release push, ID 162414351. Its private half is stored only in the npm-publish environment secret RELEASE_PUSH_KEY, restricted to the main branch. Local private-key copies were removed after verification. The release key bypasses only the PR/check rules. GitHub's DeployKey bypass applies to all write deploy keys, so adding another key would expand this exception.

Live enforcement proof used a disposable branch and copies of the intended rules, with admin bypass omitted to exercise an ordinary identity. GitHub rejected a direct ref update for missing PR/checks, accepted the release key's fast-forward push, and rejected its force push and deletion. Temporary refs and rules were removed. No production release was dispatched and main was unchanged.

The PR will include weekly npm/pnpm and GitHub Actions updates, each limited to five version-update PRs, the release credential change, rule payloads, and a recovery/activation runbook. Post-merge acceptance still requires activating main-review and confirming both Dependabot update runs. Scorecard's public API still returns 404; the monitoring work is tracked in #127.

[itsjling]

PR #138 is ready for review against main at fc134944a990595d2095346dba3a31499b77ab37. The product gate and full local tests passed, all applicable PR CI checks passed, Codex review found no major issues on that head, and the final watcher reports a clean merge state with no unresolved threads.

This issue remains In Review. After merging, activate main-review using the runbook and verify both Dependabot ecosystem runs before closing it. main-history is already active. The initial Scorecard result remains unavailable pending #127. The PR deliberately uses Refs #129 so merge does not close the issue before rollout is verified.

[itsjling]

Post-merge verification on 2026-09-10: #129 is ready to close.

• PR Add dependency updates and stage main protection with a release bypass #138 merged as 350790aadcc82fc2c1203dc0f700f060058d78fc. The release workflow on main now requires the dedicated SSH identity. Its sole write deploy key and main-only npm-publish environment secret remain installed.
• Applied the merged, reviewed main-review.json to ruleset 22360425. GitHub now reports both main-review and main-history active. Effective main rules require PRs, zero approving reviews, resolved threads, an up-to-date branch, and the five current PR checks. Force pushes and deletion remain blocked; the release key bypasses only the PR/check rules, and admins retain the documented recovery exception.
• Alerts return HTTP 204, security fixes are enabled and unpaused, the dependency graph exports 1,068 packages, and auto-merge is disabled.
• Both version-update ecosystems have created PRs: npm Bump eslint from 10.8.0 to 10.10.0 #147 and GitHub Actions Bump actions/upload-artifact from 4 to 7 #142–Bump actions/github-script from 8 to 9 #146. The Actions update run completed successfully: https://github.com/itsjling/diffsplain/actions/runs/34465743720. The npm run is still processing further updates, but its ability to create update PRs is proven by Bump eslint from 10.8.0 to 10.10.0 #147. The merged configuration retains weekly schedules and five open version-update PRs per ecosystem.
• Existing enforcement proof and passing local/PR checks are recorded above. No code changed and no production release was dispatched during this activation.
• Scorecard still returns HTTP 404. The accepted brief says to inspect it when available; that remaining monitoring work belongs to Add OpenSSF Scorecard monitoring and publish the results #127 and does not block closing this setup issue.

Separate dependency-remediation work remains: security-update runs for sharp, svgo, fast-uri, and js-yaml report security_update_not_possible, with their latest resolvable versions below the patched versions. This is not a configuration rejection; alerts and update attempts are operating. It does not mean all dependency vulnerabilities have been fixed.

Leaving the issue open for the requested closure decision.