jcoffey-dev
a63839f6b0
SPEC 2.2a says INBUXA writes its own when the repository is first published, and it is. Until now the public repository carried Stalwart's: a security policy telling people to report vulnerabilities to Stalwart Labs, and a contributing guide whose policy is that pull requests from anyone not on upstream's vouched list are closed automatically. Neither is this project's, and both were being offered to anyone who looked. So: a security policy that says where to send a report, and what happens if it turns out to be upstream's bug rather than ours; a contributing guide that says what a fork of someone else's code needs from a contributor, including the clean-room question, since the record has to stay true; the Contributor Covenant; and a sponsor link. Upstream's two security documents move to .github-upstream/ beside its workflows -- kept, not used, not presented as ours. CI builds the server and compiles every test target, and deliberately runs no suite. The unit tests only build with the integration crate in the graph, and the integration suites want a STORE, fixed ports and a container apiece, so running them here would mean a tick that skipped everything or a cross that means "the runner has no Redis". The workflow says as much, so nobody has to rediscover it. Also ignores /artifact: two hand-built binaries, ~190 MB, one `git add -A` away from a public repository.
43 lines
1.2 KiB
YAML
43 lines
1.2 KiB
YAML
version: 2
|
|
updates:
|
|
# Cargo. One entry: the workspace has a single lockfile at the root, and
|
|
# ~30 manifests that upstream bumps on every release -- pointing entries at
|
|
# individual crates would find manifests with no lockfile beside them.
|
|
#
|
|
# Minor and patch arrive as one pull request a week. Majors are left out of
|
|
# the group on purpose: they are migrations rather than bumps, and each one
|
|
# deserves its own pull request and its own CI run.
|
|
- package-ecosystem: cargo
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
day: tuesday
|
|
time: "09:00"
|
|
timezone: Etc/UTC
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
minor-and-patch:
|
|
update-types:
|
|
- minor
|
|
- patch
|
|
- package-ecosystem: github-actions
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
day: tuesday
|
|
time: "09:00"
|
|
timezone: Etc/UTC
|
|
groups:
|
|
actions:
|
|
patterns:
|
|
- "*"
|
|
# The Dockerfiles pin their base images, so this is what keeps a published
|
|
# image off a stale base between releases.
|
|
- package-ecosystem: docker
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|
|
day: tuesday
|
|
time: "09:00"
|
|
timezone: Etc/UTC
|